Analysis
-
max time kernel
149s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 01:09
Static task
static1
Behavioral task
behavioral1
Sample
693dbfaa0a8f6e9c7111f93bced04560_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
693dbfaa0a8f6e9c7111f93bced04560_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
693dbfaa0a8f6e9c7111f93bced04560_JaffaCakes118.html
-
Size
74KB
-
MD5
693dbfaa0a8f6e9c7111f93bced04560
-
SHA1
02d9820eb0ffb05c21a1915788ab2c43b8fa8087
-
SHA256
af0cc8fe2147e8bd1705fcc599c645eb1c71730d01b4cb2a20ebf7b684816022
-
SHA512
40bea3b1d1be8135839ae91599cc5cef84f281424fc20290f1b5859726b891b6ce04f160a7c7e17b220d2dec5acc7e3039b4d335ad52ebc6d83680b082761f72
-
SSDEEP
1536:iMmlNtSOsz1KTnQO8YtHh3qx9X0ghNxgefN3MU39DMglNJfXwJ0:VmlNtS4ztHh3qx9EgeefR9Dt+J0
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3136 msedge.exe 3136 msedge.exe 3432 msedge.exe 3432 msedge.exe 4976 identity_helper.exe 4976 identity_helper.exe 332 msedge.exe 332 msedge.exe 332 msedge.exe 332 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3432 wrote to memory of 4040 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 4040 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 1696 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 3136 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 3136 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe PID 3432 wrote to memory of 2864 3432 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\693dbfaa0a8f6e9c7111f93bced04560_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd092d46f8,0x7ffd092d4708,0x7ffd092d47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11345129887656231075,1955441711847576200,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,11345129887656231075,1955441711847576200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,11345129887656231075,1955441711847576200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11345129887656231075,1955441711847576200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11345129887656231075,1955441711847576200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11345129887656231075,1955441711847576200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11345129887656231075,1955441711847576200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11345129887656231075,1955441711847576200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11345129887656231075,1955441711847576200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11345129887656231075,1955441711847576200,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11345129887656231075,1955441711847576200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11345129887656231075,1955441711847576200,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11345129887656231075,1955441711847576200,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4780 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
309B
MD5ec78606c5fab6bc3dda15d0a3fa49023
SHA1230f3d936cae6bf94a2ffafe608e029c8dd993a7
SHA256673afa3abf71f4bf5cd82ee97d5d567c1c1e8d5b51433d55cc7398df95bfedf9
SHA512732f95b8a859d275cb0eb17c18773e6beafd3cba04cf7a6dba4c4bdd3d98cbbf898ca9415240522cc0e7bbd4b81813b411c3c338d6b5a330aab474115612fbb7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD56a08ae3ea93320d9ff3912374c19ecda
SHA1b5a26d2f3ec5953ef22294cdcb814b03d97b195f
SHA256639a452d8442a5051190f853f56af0244f76cb6917b561658ff2032bb0f2ca3a
SHA5128f21d8d28cf0dfc544797c195e3cb68f1a65296bb275440589a5e6e5a2370587faf6e706a361f969f5663794e7f6a648e2f38383555b8a7248960a5d8866b29a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD53af265ed869ec407e485524e7ed7d51a
SHA17b4f503114f25af8b2f37c4761220a0d5bf8cfe4
SHA2565b6befa2d81d714c2f58ad5b6d73aed3e505ad48a65bfa4c47d8deaa0a70b43e
SHA51279145baf049beab1deed61788f1b57da4da741e991d24d836951203a3bf96a83025967a402caaed5c45df9816cc167b72b32239cb6a822b535660d6ab97f3b20
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD51e00f82d1d9e786286a84a68aff8fd1d
SHA131ed73e5c8ec09d9144315be128078507fa66940
SHA256237b95e09ced541da52deb440eb89dd31de4c76cdb2dbfa2605089a8465ce39a
SHA5123f54193330be43cf9f4412e6a3035da2f7ba3deb9c5a92bf8813fbf5d09482966cd6d417e18355b8024dfbe55616c3e2061031dae4173cbb85a9d07119426b96
-
\??\pipe\LOCAL\crashpad_3432_JSLFFOGGUGORIBARMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e