Analysis
-
max time kernel
145s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 04:01
Static task
static1
Behavioral task
behavioral1
Sample
69ab49ff3f246b650e1fa6b8c948d69e_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
69ab49ff3f246b650e1fa6b8c948d69e_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
69ab49ff3f246b650e1fa6b8c948d69e_JaffaCakes118.html
-
Size
348KB
-
MD5
69ab49ff3f246b650e1fa6b8c948d69e
-
SHA1
758fa0ebf6f0a7f713430a532084fbead269169f
-
SHA256
48715a269a42eeca2759066c6afaee27cc6bb3756715eea53340b7896a8e9263
-
SHA512
e8e7820394448ab4671b3f0ef69c8e642a7ab65b1166347c4c546d3ca901298cbaebd8f12e9ac986551ed52c52c6dbe021c7bdddbd8b98c1a6f7135b035e50cf
-
SSDEEP
6144:osMYod+X3oI+Y5sMYod+X3oI+Y5sMYod+X3oI+YQ:25d+X3b5d+X3f5d+X3+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1424 msedge.exe 1424 msedge.exe 1180 msedge.exe 1180 msedge.exe 1464 identity_helper.exe 1464 identity_helper.exe 3136 msedge.exe 3136 msedge.exe 3136 msedge.exe 3136 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1180 wrote to memory of 920 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 920 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4440 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 1424 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 1424 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe PID 1180 wrote to memory of 4668 1180 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\69ab49ff3f246b650e1fa6b8c948d69e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf8b746f8,0x7ffaf8b74708,0x7ffaf8b747182⤵PID:920
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,16687439405084105489,16125088329065509812,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:4440
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,16687439405084105489,16125088329065509812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1424 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,16687439405084105489,16125088329065509812,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1496 /prefetch:82⤵PID:4668
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16687439405084105489,16125088329065509812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:4092
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16687439405084105489,16125088329065509812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:4592
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,16687439405084105489,16125088329065509812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:82⤵PID:396
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,16687439405084105489,16125088329065509812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1464 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16687439405084105489,16125088329065509812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:12⤵PID:3988
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16687439405084105489,16125088329065509812,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:12⤵PID:3480
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16687439405084105489,16125088329065509812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:12⤵PID:2000
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16687439405084105489,16125088329065509812,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:12⤵PID:4572
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,16687439405084105489,16125088329065509812,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3084 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3136
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1516
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5e88ad3c00f2bd9ee0030927b7425389f
SHA19d735633377912f6f7a7e62d61bb45338cc93949
SHA2567f82b573a21b57f88741e572573294c54ede9b94e8e72c7690152ada9aed1c77
SHA512ce7aded3f8890b51738fc0885eb545aa4ae4880f65ada3a86a4dd4a555d4812945114288c1b61d47cd97026a7ab6ce328cc8178e6ac9a07b31d017de2883a27f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD553d734c34c235fca29d3865ace498108
SHA1752c259ee16a05f9f13d1faa353415017605e1f3
SHA256ce4fd74ace26db84d3d6c1ab4feb6182708762bf0b60a81ff34d5af54a468043
SHA512775d77f62ee596f00fdf2b0dd798a48848bdfdb475453b345912ba26aa383cdc0a388487735c55574aa677dfc7b8a2fc9dca73275e22bfcbaa277e735091cdeb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5c7ab2ce10771d6852defdc4fa0e5743a
SHA14036f3300cee5e77685a010062eb67757c5052cf
SHA256e68b926ca63893fdbda7b6560cf06cf1dfa55c074f54ccd6d063c87ecb64cbb4
SHA512aad349f8e3c0c10846af12bf2d5bc522851f0ee7ac8c9a24336587084e52fed196f772379cceddedff708558d708718ce6046b6a4d8892b3d4165f9a9c50a465
-
\??\pipe\LOCAL\crashpad_1180_EVMDZKDTAQPXQYSUMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e