Analysis
-
max time kernel
145s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 20:32
Static task
static1
Behavioral task
behavioral1
Sample
6c2b4992c577f006a2d0563508565f80_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
6c2b4992c577f006a2d0563508565f80_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6c2b4992c577f006a2d0563508565f80_JaffaCakes118.html
-
Size
185KB
-
MD5
6c2b4992c577f006a2d0563508565f80
-
SHA1
de43e610bc85773ef1d8653c4aa7297570e4fec3
-
SHA256
d7314b56107e5c87c1574c183dfc79fefb6ba06febc52767dc98046d3739ce23
-
SHA512
90ca9d43bad52aa505c18dd9a912ea75e8d5c01df36555d766b6541e10b6487685f1a8fa2f6aa72ab72fd5ec162e122039794da53dd9b687f02b4d3107e4d2f7
-
SSDEEP
3072:WxDNvG8rm/GXmNJUNBVTRQUe+ErvfnLIgufWyHb/th2wHngwDWERa1:oVXmNJo81
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1028 msedge.exe 1028 msedge.exe 4532 msedge.exe 4532 msedge.exe 2352 msedge.exe 2352 msedge.exe 2352 msedge.exe 2352 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe 4532 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4532 wrote to memory of 1720 4532 msedge.exe 81 PID 4532 wrote to memory of 1720 4532 msedge.exe 81 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 4752 4532 msedge.exe 82 PID 4532 wrote to memory of 1028 4532 msedge.exe 83 PID 4532 wrote to memory of 1028 4532 msedge.exe 83 PID 4532 wrote to memory of 4848 4532 msedge.exe 84 PID 4532 wrote to memory of 4848 4532 msedge.exe 84 PID 4532 wrote to memory of 4848 4532 msedge.exe 84 PID 4532 wrote to memory of 4848 4532 msedge.exe 84 PID 4532 wrote to memory of 4848 4532 msedge.exe 84 PID 4532 wrote to memory of 4848 4532 msedge.exe 84 PID 4532 wrote to memory of 4848 4532 msedge.exe 84 PID 4532 wrote to memory of 4848 4532 msedge.exe 84 PID 4532 wrote to memory of 4848 4532 msedge.exe 84 PID 4532 wrote to memory of 4848 4532 msedge.exe 84 PID 4532 wrote to memory of 4848 4532 msedge.exe 84 PID 4532 wrote to memory of 4848 4532 msedge.exe 84 PID 4532 wrote to memory of 4848 4532 msedge.exe 84 PID 4532 wrote to memory of 4848 4532 msedge.exe 84 PID 4532 wrote to memory of 4848 4532 msedge.exe 84 PID 4532 wrote to memory of 4848 4532 msedge.exe 84 PID 4532 wrote to memory of 4848 4532 msedge.exe 84 PID 4532 wrote to memory of 4848 4532 msedge.exe 84 PID 4532 wrote to memory of 4848 4532 msedge.exe 84 PID 4532 wrote to memory of 4848 4532 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6c2b4992c577f006a2d0563508565f80_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd168946f8,0x7ffd16894708,0x7ffd168947182⤵PID:1720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:4752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:82⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:4104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:3960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:12⤵PID:3184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:12⤵PID:1744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:12⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:12⤵PID:4856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:12⤵PID:1600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2352
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3040
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize330B
MD5c5a1825ad30a16f88d9d2e3a8142d41a
SHA13e2f53c3c00a73bf97ec5c052732121918ac58de
SHA2564d82d3f22ee7fe4b3c5ad1193155bfdaa9eff91cfc80dc02490cbbd75224a256
SHA512399384453543e30078b942ada951e6853398c7dadfa89ca33550abf3aebfa4dc8b45ef9e3ff3cdb852ff462d1579d9047f3a10a1397345e39d1fc4f9da4b9091
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
20KB
MD5b6c8122025aff891940d1d5e1ab95fce
SHA1a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
SHA2569954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
SHA512e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10
-
Filesize
44KB
MD588477d32f888c2b8a3f3d98deb460b3d
SHA11fae9ac6c1082fc0426aebe4e683eea9b4ba898c
SHA2561b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8
SHA512e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize456B
MD5ec2a8767463d6d00cc8436e35c86d061
SHA187dc225617070a1156da68a0e1909ef7e41dc012
SHA25638b22d9fc7af813452a07aca5dba58a8440d4e79b7b79f01927b8a61d510c039
SHA512deb7bf283efa839f5994b3937277abf43924bcd38ea8d94f3d5dec2ee8cf42065e4f78a406e03f66630d55ecccc33cd602a7609fa585b1f08ed0fac2e7cff693
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize432B
MD586db7bb6857a295293c0eb5d72d4e158
SHA118d05bddd73a892b66f2a74a2b12229c9f49d757
SHA25632c82633fee8bca310ab317feeba0d2266b4600cb05e8e64bae5bffc93a07021
SHA512e95b00de2c7d5c3d2d1546ddb7fae0be5ab402afedaf09fe5023f16380f748f04601ef5284da1610a22d7e0eabf13be45e8f418aa1acd17464b9396a61a81a7c
-
Filesize
4KB
MD558361418230f5ea7b29c258b723ee7de
SHA1e88061dfaae8e18cf10d4bc768ea06ff145a6f05
SHA256ce997a6f4ac7efdc7ed401a6aecc2eaee0aa060a829cca149725e14f352a45e0
SHA51279d5ef3d2ac640e35b49f3b5010de5d890e23edc6bae997a310f7014cdad49a48fbd9af19787b61599e97fb13bf3a56a7c72d79845e87b98b9e42e02d2b1433f
-
Filesize
5KB
MD5306c50595aded9a268b88dfc1284c47f
SHA11c9d81ded1b089451cab3a8b81be41f8c120ee3b
SHA2569109ace2d2c6e35b798dfcaa09a43b6a2f70fdb05fe883ad153e3624227ab87f
SHA512ade04f989291ad4d67e3290f92a12a6eeb56174642045f57b7fc26ca54996b68332fab62c23885c418a4db8d1352ec332f3285fcf76d2afd3209f017ab25fa33
-
Filesize
8KB
MD57b3a4f81e00a6a24fc3153c00bfdfb24
SHA10bdbd0dfa53f47deb1d0714af544c944a6bd0c7d
SHA256552d473b49cfa559bc0a2edeb0de7a0e190abba5821b014ccd5b8670b49b80a9
SHA512a4d1b3b07d94f151d06f898a65fecb18a5ac65cfe62c7966181f0659426bd5500228a31d7894b1b3cce0825c291ea870dc10803bfb5afcf5698c5bf9b37cff58
-
Filesize
11KB
MD516c9a729229fd5aea16e7a15689de13b
SHA10a54d93ecf9a0a218e564ebc00320897ad08e46c
SHA25612074f4bbe5164a8e9a22f4e1b2ae4ad1007eb4d215477eaede36ffa3da1b87c
SHA51273b70743bae0aca0286364d6d35a5c9ebd0fcd13ae596532ee4f74bf133b173366916e85340b38dfdb9723cc3ce9235a21bb5e4230686b5e4967fa955a697e66