Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 09:13
Static task
static1
Behavioral task
behavioral1
Sample
6a734e6f57cdd1d7e17b32dc5e1ce6c7_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6a734e6f57cdd1d7e17b32dc5e1ce6c7_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6a734e6f57cdd1d7e17b32dc5e1ce6c7_JaffaCakes118.html
-
Size
364KB
-
MD5
6a734e6f57cdd1d7e17b32dc5e1ce6c7
-
SHA1
dd5c3752442f88673d45e4c140c109087f4ee730
-
SHA256
d56bee7ef39df1f62c292a734164a3f31fe8558972bd1b1d55cd53e93356ebf2
-
SHA512
a9a40b5377c4946c66adce1ad3cdb825c43e7fe615a598a5d8cc503952225c9e78d488d4747f2a5a18e42555b5a0d9b5ca59fa3594bda91b7d302928d6b494dd
-
SSDEEP
6144:SqsMYod+X3oI+YYWrvUj6/sMYod+X3oI+YcsMYod+X3oI+YQ:75d+X32GUj6D5d+X345d+X3+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exemsedge.exepid process 4568 msedge.exe 4568 msedge.exe 1908 msedge.exe 1908 msedge.exe 5004 msedge.exe 5004 msedge.exe 5004 msedge.exe 5004 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
msedge.exepid process 1908 msedge.exe 1908 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1908 wrote to memory of 1592 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 1592 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 3512 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4568 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4568 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe PID 1908 wrote to memory of 4580 1908 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6a734e6f57cdd1d7e17b32dc5e1ce6c7_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c93a46f8,0x7ff8c93a4708,0x7ff8c93a47182⤵PID:1592
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,18088154210062151509,10560389265098455578,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:22⤵PID:3512
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,18088154210062151509,10560389265098455578,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4568 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,18088154210062151509,10560389265098455578,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:4580
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18088154210062151509,10560389265098455578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:3576
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18088154210062151509,10560389265098455578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:420
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,18088154210062151509,10560389265098455578,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1328 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5004
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3540
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD586758fc058b4845c5a0ef146bfa4cad4
SHA1386e27230d20926d0400cc46ab46286c38bd50ab
SHA256f4d35f790e1ec694bd8fb2e522686736140ddfc2158c1ac536217e943132e530
SHA5125b4affbbaa97ad156b80fe0d25175d6cf6afcadcd659489b08f2c3760110d5fabeb357533882d12ddc8af02e3eecb74c548ff126968cc68f2d559d74fb6652a7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5b7e2ab801854ca891e064e4e1500dd47
SHA179fc7377b8b8a084817d9be2a6bbd8376a76d0c3
SHA256c110409a7a9e301a8a0065e95d2bd82032b1aedc70510d911c6a32e603f94aec
SHA512787d52cc14a524af5278c043207288595e097a8ad4d61f23ff7bba2a16d269e211cac72a4a55109a3fb20b72f168b274e2d21dba2f7425a5362d0ef3cb91af32
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD59a030854df72ade1a816ce4b93014ab7
SHA1d0bd49abbe8bc483f2b5d7a05bb7b1eb223ea88c
SHA2563c53ab24f20c6ecd17a5d1ae72dadfd57689e67462df5f359852bc5759a0b929
SHA512e2ec2951e0ea0d5b0db50971e6ac36c2c770e16b4f1fd7a6ef640dddad7d2109c260193510e1cda81de49b9a1252e11af087c20b0a8c256c80abca40676c5c99
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5e1b032bac385b4715bb632601556d8e4
SHA1f42bafdf40da8168fbae655667020666ed03e926
SHA256afd098da6ad6023707d592737591f8bffac794956d523c2633ec74a3ca1d43e0
SHA512008e0315eebd718095559a9bb71bf68e729f7f4461b38e4deac7d7048c33a7e4db574b7e2cf60bce1ef1668a681bc405266c7771bc0bc11905df6cec9375f6d5
-
\??\pipe\LOCAL\crashpad_1908_PAMCESDYZYSURPYCMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e