Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 01:53
Static task
static1
Behavioral task
behavioral1
Sample
695b0f6cbd15f1833e77828802dc1601_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
695b0f6cbd15f1833e77828802dc1601_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
695b0f6cbd15f1833e77828802dc1601_JaffaCakes118.html
-
Size
139KB
-
MD5
695b0f6cbd15f1833e77828802dc1601
-
SHA1
3c095953fb847793b593a5310e8b1de09256cf06
-
SHA256
03bee1899ab872020960eaff5e13bb2ca96745691ad4b2fabaa4e5f07237b602
-
SHA512
01f13c46fd9ec54374e884165056fbe2f43cc1ddaabba1cc510b05f9155869b2e07e499db76c917e9f12bef49908f42f4155450c752d05ecc06213a40117ca73
-
SSDEEP
1536:StTx4xtljyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:StozyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exemsedge.exepid process 2020 msedge.exe 2020 msedge.exe 2788 msedge.exe 2788 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
msedge.exepid process 2788 msedge.exe 2788 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe 2788 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2788 wrote to memory of 2408 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 2408 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1000 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 2020 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 2020 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe PID 2788 wrote to memory of 1540 2788 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\695b0f6cbd15f1833e77828802dc1601_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad02946f8,0x7ffad0294708,0x7ffad02947182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3790754259858468038,1995566596611803823,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,3790754259858468038,1995566596611803823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,3790754259858468038,1995566596611803823,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3790754259858468038,1995566596611803823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3790754259858468038,1995566596611803823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3790754259858468038,1995566596611803823,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\364a3411-cc71-4339-a1e1-4d3e092c2626.tmpFilesize
6KB
MD5741031ee7b3bf04afbdc7e5b45236553
SHA1231a584d7c555023e0e3f6a312b13f68be864639
SHA256977c8eadcf8dbc50fd1502eb7041e914f1e729eff893da92c3f351c33d18ccf7
SHA5126c6e10156f9d004795d38d3577f75bdd10346803ee06a7f795a1a944b281cf485b53ed8dd4b76d319207462f7d501d9a1554892c3db5ab945d3fa5ac202ecccc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5ff3afca51c8a54fa8d1a6171099e9960
SHA1bc8dfdc6f8ae4ba4e788ddddd706fb4c2e649c2f
SHA2561cba7ed12e925ee93d244be0d9d86d5603fda8b48a1f8d31f45674b38d0e1918
SHA512028973db2ecf782098a784879c4bb038053b3a22b6d863632af25f5c58a839d7c2970c83fc5f5075357da3d3d46b65cefb8102f17dcd8b0b5e3384d68bd6e428
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5d835476c749741e8f4d91dde540a79a6
SHA1965d5baaca42f28e03aa22b6f4c9959935cb7c3a
SHA256ae95df684255be91bc6e27efef739134f74b4c577cc46187457dec9b68370a3f
SHA51295acb6d927b754d10b0efb5a238d5198c235bf5b42f15440ed34961edb1092127defa4eef4975079a147e3da8c0b066a90811892a66db7e47702496c0b190cf0
-
\??\pipe\LOCAL\crashpad_2788_ZZIYYSYXAXMTRAGDMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e