Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 00:49
Static task
static1
Behavioral task
behavioral1
Sample
6931e9ac2dc05354ece78f8a0e5a1812_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6931e9ac2dc05354ece78f8a0e5a1812_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6931e9ac2dc05354ece78f8a0e5a1812_JaffaCakes118.html
-
Size
21KB
-
MD5
6931e9ac2dc05354ece78f8a0e5a1812
-
SHA1
e4e69162713fba8ecfa28118b22c92034cf6f3ea
-
SHA256
b4d1005f624a46c082bfcaa43b5f6c89bff11dca83d689504bf22973902feab8
-
SHA512
ae0e1eabf958a36f9114d9b9a409c81409009b75da4cd7042afc1b7ebf2444daeba84fdd75fb0d20339977ca95cd2c2574b6f8b7c7f7efd7b83dd0b56019fce6
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIv4BzUnjBh7t82qDB8:SIMd0I5nvHNsv7WxDB8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exemsedge.exepid process 3132 msedge.exe 3132 msedge.exe 1652 msedge.exe 1652 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe 1556 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
msedge.exepid process 1652 msedge.exe 1652 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1652 wrote to memory of 5000 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 5000 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1788 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 3132 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 3132 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe PID 1652 wrote to memory of 1208 1652 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6931e9ac2dc05354ece78f8a0e5a1812_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff825a646f8,0x7ff825a64708,0x7ff825a647182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,13321362951574010137,2747965221370007914,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,13321362951574010137,2747965221370007914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,13321362951574010137,2747965221370007914,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13321362951574010137,2747965221370007914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13321362951574010137,2747965221370007914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,13321362951574010137,2747965221370007914,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2776 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5323aa6e601e149ca12ff4054c06e7091
SHA19e50d6b8037534058d73d118a56c32c32430cbf2
SHA256d68bd97992c1ca3cb4e8716bf3b0b3df151747d95f4f200f78e3e8a497d437fe
SHA5122814000af5496e336a9eb73a42abcd23c4b934b0d256888ddd6c0331050e0a38b7e65866c7b9e10d68226d8cdc78c0c6b7fb7dc133efe62c939b17580336889c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD53935415df694929310f72958d9a5bfc1
SHA15190083af475a313d171df9e3881b171d05eafe4
SHA256340d299a07b17b4ffb571401f3f3975cfe513d9dcbca370185b23c7aa661d3e1
SHA512f05a207f52a3f6c4444d39853596927e97efd774a8583554679c5800a51635d5bd0c4d6f9defe3f7788b030b5638fc807eb2a9bd2288a6c734641e41e1b1284a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD564305810a6d08d21a114e980822620b7
SHA114822bf1db0721e2341022f58f0160e6d095ac3e
SHA2569e6450e5624b0a49918699bb652b78a380ef1c85abcbcbf8e561b6174ef765dc
SHA512847b1b2394032ac238c5d1e1eabd034daecf6444e4bfba5aacc33522935cdf81fabc76825f3f6596bfe69ea004e2eafb612d74512e7c48ea85855623bd40b31d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5b27621828323a00aa14588d05816553c
SHA1a1bb094d28438a817f1eae9d4a4197edb2e5ffc9
SHA2560a434f2b9520bb304cd741f00ad04e3f10865bfda651d2fba207ac5e26cc11de
SHA512dd8ce827e4f8735208ec86d019382b6cd664c5fd59e0e501687a4f1512a581045f6aa5d0af2909ab5e1d6cb6ba06bc49fafdd9955a332e66214525324919142f
-
\??\pipe\LOCAL\crashpad_1652_XFTSZFXXWBEYIWTYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e