Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 00:07
Static task
static1
Behavioral task
behavioral1
Sample
69176472c524213527b027ac6304c7da_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
69176472c524213527b027ac6304c7da_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
69176472c524213527b027ac6304c7da_JaffaCakes118.html
-
Size
65KB
-
MD5
69176472c524213527b027ac6304c7da
-
SHA1
f8594294e28e8e960ab25c7da30e47653e9a1a67
-
SHA256
88aee7c56da47a557fef446659e7ae14532596e10a7e89361d3896d977faffce
-
SHA512
2f7211b2d53d8c5223013cd9bf98f2cc48cb2e692da525db6688daa3d6b753d1832c898a38b13c51ee7e866730ce55ce75fba74d3e9c4b8d93c8f346897227df
-
SSDEEP
768:JiFZgcM0St8tN99OIsH457RQ7XoTyFhCZkoTnMdtbBnfBgN8/oycc8QFVG8sP/IV:Jb+LScTwgec0tbrgaCcFNnzAC
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2924 msedge.exe 2924 msedge.exe 4940 msedge.exe 4940 msedge.exe 2252 identity_helper.exe 2252 identity_helper.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4940 wrote to memory of 2788 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2788 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 512 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2924 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2924 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe PID 4940 wrote to memory of 2260 4940 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\69176472c524213527b027ac6304c7da_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0aba46f8,0x7fff0aba4708,0x7fff0aba47182⤵PID:2788
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,11188114035653083145,12672721613670612931,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:22⤵PID:512
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,11188114035653083145,12672721613670612931,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2924 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,11188114035653083145,12672721613670612931,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵PID:2260
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11188114035653083145,12672721613670612931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:3752
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11188114035653083145,12672721613670612931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:4724
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,11188114035653083145,12672721613670612931,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:82⤵PID:3708
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,11188114035653083145,12672721613670612931,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2252 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11188114035653083145,12672721613670612931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:4536
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11188114035653083145,12672721613670612931,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:12⤵PID:3824
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11188114035653083145,12672721613670612931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:468
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11188114035653083145,12672721613670612931,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:12⤵PID:664
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,11188114035653083145,12672721613670612931,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=180 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:212
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2652
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
5KB
MD5c67056ac0f690f9f37a661cb4668cd7b
SHA1c2084934d677ffc1f6115fe773c47bb7fda4c0a2
SHA25610cabc83d6425f701d77961d6a2b1f6088b9f7ede6d939414b49cd72453861b9
SHA5126737f480d2baf653b3ef56712a31a6f03a15f3b6cfa7af9f5e59ea10944f053f209666a64972e9ad0b8e44af01b5b586a50858c7b925928ed132a332d64a75bf
-
Filesize
6KB
MD551b4802aab86c1bd0cf79679e354109c
SHA1f4948f851bf6d9435044d0260451d51e440be94e
SHA256f305bff328407a3bbeb5ca059de55304b4f2f2e9f57beae8aa184d6a78738c91
SHA512e1af47cc5fa8d40cf29561a29cc9b09351d35e3db8bca23be2b5b753b315ca4121c55a25a5e25f7906330f738adafbacfe3b31bfc2ebb1cf9e7a1419841be9d1
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD574a438ced1111e812408af88e3d268fa
SHA14e0b20adea26e1557967713ed33b634b167b2713
SHA256de7fdf105ee5f708320d82d39e97e30c95630a5d8061019013988364bf8110f8
SHA51251df533b4ca3be9d3c1bd6f7e253ea2433e4e71cd10e821b87c82303b6f7e161c258a72cf2c5f485d427a1436e629fd346fcfe83381084ee3b8ce416733b3232
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e