Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 05:32
Static task
static1
Behavioral task
behavioral1
Sample
69e4c14088abd66dd2cf1a20cc7b6b58_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
69e4c14088abd66dd2cf1a20cc7b6b58_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
69e4c14088abd66dd2cf1a20cc7b6b58_JaffaCakes118.html
-
Size
158KB
-
MD5
69e4c14088abd66dd2cf1a20cc7b6b58
-
SHA1
1cd52604c2ffe924a78e64f3058b56103d39d7e8
-
SHA256
90595baa1c078a496859a6938fd43dd4b15c56fb6681d8bfc3a5da78a2d44642
-
SHA512
69e90a1921d757eff57eb076ed124c0d5e67afa018e251cbfe7e8a08849dc850164c813365c4be06eebeee273286b59cca48bd7b202e6cf10ae0dd0eba533a3f
-
SSDEEP
1536:i8RTqPpeZY0PSZ51lyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:i+XqZ51lyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exepid process 3624 msedge.exe 3624 msedge.exe 1196 msedge.exe 1196 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 5016 identity_helper.exe 5016 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1196 wrote to memory of 4552 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4552 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3596 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3624 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 3624 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe PID 1196 wrote to memory of 4904 1196 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\69e4c14088abd66dd2cf1a20cc7b6b58_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff935e46f8,0x7fff935e4708,0x7fff935e47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1780,1464253670943436017,8582911049665190405,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1780,1464253670943436017,8582911049665190405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1780,1464253670943436017,8582911049665190405,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,1464253670943436017,8582911049665190405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,1464253670943436017,8582911049665190405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1780,1464253670943436017,8582911049665190405,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2784 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1780,1464253670943436017,8582911049665190405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1780,1464253670943436017,8582911049665190405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,1464253670943436017,8582911049665190405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,1464253670943436017,8582911049665190405,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,1464253670943436017,8582911049665190405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,1464253670943436017,8582911049665190405,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD58fea6efd17de10f1d77796b7aa2bb103
SHA12eb775e18182a27414822024dc93612385ce3e86
SHA256ddd8b0fe8eff34eb055f5a82b13abcfd5d1228da3e0977cb34e860687e484ee2
SHA51265e39838dbde8ad934c8479a449782df08723086f474e2e147f3510608cc1ef5e870969ea9eb578d2e1e84111abca6c0159011e7fa3a80f7649d36a7afdd721c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD51a53084b089c53ef9513f7405871cc2a
SHA10a81af3927d6101db2eee2dc0ab1161082624a5e
SHA256ac543064376998005fd001e06e108b58800ecef16028cbb2cfdbb742fb14802b
SHA512a213b37fe55266697baa9be231b3af17ce63bb3043ebd0b48ce6751a5b958548f3367c2ab3bc9206b328ad19f025587beb82527baf5122c22150c71f6770c14d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5c80ea0edd7abc314712550fbf29d81a9
SHA1fd32b58c80c1ff0abea2919d640ad7851fef2d72
SHA2566fa0c474e838dd1320d1722b6dbcdf9e179112274304d32ec1a1ca2d98096c07
SHA51288cabfd12bc86e4ccf2ea419576823b07b9b9a41e44d5a3812446beedb07c5de18163cff792cb978701d81f6cb46c9b8c1b127f34370833969f05b23e850af9b
-
\??\pipe\LOCAL\crashpad_1196_AQFVUWHXTYBCZGZUMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e