Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 21:50
Static task
static1
Behavioral task
behavioral1
Sample
6c5f6d5d69a9c7d3a6f6768848364abc_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6c5f6d5d69a9c7d3a6f6768848364abc_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6c5f6d5d69a9c7d3a6f6768848364abc_JaffaCakes118.html
-
Size
386KB
-
MD5
6c5f6d5d69a9c7d3a6f6768848364abc
-
SHA1
f6846aac1be67eb03f3b05e4c43c978c6ecfe834
-
SHA256
2a51a41338359193fbe7abee2c0fe9de10c9e959f4b65e53af2d68d8aa2c8d7a
-
SHA512
05d9e5dc18468620343ff5341fcfcd0f99e3f847a7ba3b4d14abcdf3bbcb6fad46363011e0a0f6023ff2aa08a82bd18ee3d45159f90c249bf2b610cb8cbea9f4
-
SSDEEP
6144:S2+sMYod+X3oI+YwsMYod+X3oI+YLsMYod+X3oI+YQ:k5d+X3I5d+X315d+X3+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exemsedge.exepid process 1588 msedge.exe 1588 msedge.exe 4412 msedge.exe 4412 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
msedge.exepid process 4412 msedge.exe 4412 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4412 wrote to memory of 3368 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 3368 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 2900 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1588 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1588 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe PID 4412 wrote to memory of 1396 4412 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6c5f6d5d69a9c7d3a6f6768848364abc_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9584f46f8,0x7ff9584f4708,0x7ff9584f47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,4156650708509557527,3697788277119688687,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,4156650708509557527,3697788277119688687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,4156650708509557527,3697788277119688687,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4156650708509557527,3697788277119688687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4156650708509557527,3697788277119688687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,4156650708509557527,3697788277119688687,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3116 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\772f18df-bf4c-478b-847a-5d6b5ea5503c.tmpFilesize
5KB
MD5f25912777c1c86b641c9751bba83e202
SHA15b3efbba77aa8b61e348fb94f1ba5cfe06b9ced8
SHA256c8f23d5e5418032107753e984fc56bfe6d60b739494cba9c730b49bc2200b990
SHA51258c0e482697a89da3c413eda71f4d35e0fe3be56c4711ae4b10eb94d8e610cd8a28600c461c89efb040fdf7ba10de09e9bdcb07c29a83f3c0a9cdad7f0ed5cdf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5451c4e131b011fb888b3b4e6fd778231
SHA1dc2b29ba2f58ce88253078ae668b15e77e3884ec
SHA2567ad0ceb6fddfaab040b3719071d2e7e945c7683fc13622646b405cbe413c8c27
SHA51211af8ad1318a64612541a4e8f4924e9f39121f9cc44a6149d89f2a7dc85760f21059c1ecf5a41683331ce85b9da752af84755057ffdaa7b7653255bde3f66964
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5d3c7a025803c4f5c63df05f2ca4b241d
SHA169c7bd7c1b2e9493d37b5fae488de502fe998252
SHA256a6e6e962b3054dc98953c5dc803e3a4267f6eec00201373435abac5122844d86
SHA51219f736e9de0187ea61feeb14f73328a255abb8dc7ef2bd00ffbecf59addb0e8dceb62d52a0aebc27cb7d8709d961b269587377fd6e8bef6c607042f279535c6e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5da3328c681c022d39169fdf0908dc81b
SHA1c27f4211635bb4f0851ead60d7aaaa944c5f7067
SHA2564cf4f9c7feedff66e05466040b6240e136ba8b9a3aa6bed998b9bbfe290e1305
SHA512f471a8508c863ea77eb54df228fd1864277ec5de11ad27e264ef96be41f45b02bc4428611752c3d220bcd624e4950c47e9aa50bac5517d943adb3f5e23c5c2a6
-
\??\pipe\LOCAL\crashpad_4412_EJSSLRAKGIKMFQEPMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e