Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 02:08
Static task
static1
Behavioral task
behavioral1
Sample
69666a4c3be7cf9162a2eeb66eab610e_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
69666a4c3be7cf9162a2eeb66eab610e_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
69666a4c3be7cf9162a2eeb66eab610e_JaffaCakes118.html
-
Size
19KB
-
MD5
69666a4c3be7cf9162a2eeb66eab610e
-
SHA1
fbc52f448c78dae21b5f11fad2e39204e654f042
-
SHA256
601f475222875d3a563a2c20ccf62dfb5c91714643fb00057c5eb73895e99528
-
SHA512
91e80ae54d025043bd7dbe5c70b80815182470d31a06ad6f231ac5b5925fd0098ac43f2ceae8c0394192841c4bdb035e015efd47aaa1b30df682c599e97a4c91
-
SSDEEP
192:uwH6b5nSu8nQjxn5Q/xnQie0NnJnQOkEntbrnQTbnxnQmSgHMBUqnYnQ5ZNnlnQL:gxQ/YqCLR
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3628 msedge.exe 3628 msedge.exe 1692 msedge.exe 1692 msedge.exe 4380 identity_helper.exe 4380 identity_helper.exe 5136 msedge.exe 5136 msedge.exe 5136 msedge.exe 5136 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1692 wrote to memory of 1208 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1208 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2124 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3628 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3628 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 2636 1692 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\69666a4c3be7cf9162a2eeb66eab610e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb315a46f8,0x7ffb315a4708,0x7ffb315a47182⤵PID:1208
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,5293673122587091456,1727682490189193700,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:2124
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,5293673122587091456,1727682490189193700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3628 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,5293673122587091456,1727682490189193700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:82⤵PID:2636
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5293673122587091456,1727682490189193700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:4728
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5293673122587091456,1727682490189193700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:4668
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,5293673122587091456,1727682490189193700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:82⤵PID:448
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,5293673122587091456,1727682490189193700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4380 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5293673122587091456,1727682490189193700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:12⤵PID:4352
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5293673122587091456,1727682490189193700,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:12⤵PID:4836
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5293673122587091456,1727682490189193700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2108 /prefetch:12⤵PID:1296
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5293673122587091456,1727682490189193700,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:12⤵PID:4332
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,5293673122587091456,1727682490189193700,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1876 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5136
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1248
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA2565009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
-
Filesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
Filesize
6KB
MD57f2cd9d73e52eba1c205404392a03cfe
SHA16fece7495f018911d5c8e715e105fa205a58f9e6
SHA256f93f394f85b3b4890d3dd57ed49c41b2f818f5a1d75d6e9ce4ad4f72f0d30388
SHA5128a619279c8ae8c3d226a779d2bbf84c8aa70a6a0bb5b1e69081d53b7918f85cf404def37fda99a9e705b8e874e78d654daadc21e4e0c6da22a28effb040beed7
-
Filesize
5KB
MD5fb9f4b6145e97e253882c86b0e9b5a94
SHA1b3f5d6b0bb1c6242969d135442ee7e3294515376
SHA25690a8fcceb62d0bb9d8baff10a12cdfe72ce25e7e53357288377f3014f634ac88
SHA512136e6f02db692153706145a4c38b1ed450e63007c44fc6c131e2773e0fd735f810ac9b331122e4a3259ad13a767a8c26ee1148d4636d976c6259b80e10e8f9e4
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5039cff3c1fd6fb5fc97caf8e33cffb88
SHA171dd0ef83a49656c0588af8ce3d0db27726d494d
SHA256da3c5b4dc0cbb35bfea8b98f0dec239146a76bf04113e5828620d5ae63c31613
SHA512634e23f099db0b80b7ab64e8d140221a54f970b5f1ca550340d232bcf27da8507b2064a9fb70be08e3324e58694c408b84c3a350396889c2b009f5969e082f0b
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e