Analysis
-
max time kernel
139s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 23:24
Static task
static1
Behavioral task
behavioral1
Sample
7023897b2d728c9070c05ac43fdd1a1d_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
7023897b2d728c9070c05ac43fdd1a1d_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7023897b2d728c9070c05ac43fdd1a1d_JaffaCakes118.html
-
Size
160KB
-
MD5
7023897b2d728c9070c05ac43fdd1a1d
-
SHA1
cb952bd796c6fb08a4fde3009913ce5b3aa4f566
-
SHA256
813c758c476269ee8bcfa8c41333d9736eccf7684310d19623ff4ae53f3e8cad
-
SHA512
158f5755c964fe65476347f34d0f15002b4d420763ada3bf6525da59a601679d95c55a7c0259714d94b58226a41043394d1d857f983a8d5afcfcbb4884de34a1
-
SSDEEP
3072:iNFiWVLv+yfkMY+BES09JXAnyrZalI+YQ:i/iWVLvbsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exepid process 1008 msedge.exe 1008 msedge.exe 2528 msedge.exe 2528 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 3988 identity_helper.exe 3988 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2528 wrote to memory of 2496 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2496 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 3236 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 1008 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 1008 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe PID 2528 wrote to memory of 2396 2528 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7023897b2d728c9070c05ac43fdd1a1d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0ddf46f8,0x7ffc0ddf4708,0x7ffc0ddf47182⤵PID:2496
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10331892143458365392,15168646073860271471,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:3236
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,10331892143458365392,15168646073860271471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1008 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,10331892143458365392,15168646073860271471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:82⤵PID:2396
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10331892143458365392,15168646073860271471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:4196
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10331892143458365392,15168646073860271471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:3968
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10331892143458365392,15168646073860271471,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4556 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10331892143458365392,15168646073860271471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 /prefetch:82⤵PID:832
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10331892143458365392,15168646073860271471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3988 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10331892143458365392,15168646073860271471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:12⤵PID:4476
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10331892143458365392,15168646073860271471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:12⤵PID:1376
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10331892143458365392,15168646073860271471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:12⤵PID:5072
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10331892143458365392,15168646073860271471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:12⤵PID:756
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1144
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA2565009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1f3a1d71-cda0-47ba-9930-8bf70934e345.tmpFilesize
6KB
MD5eb894e0593ee7b8aa28bfe294c940618
SHA12932a3dc71404e0cc34e1509c923ea48176bb382
SHA2566889abc95f2da599df6e4552b962146a5b48a0ed35f8d354d5bd1ad24cb3ee47
SHA512d8f5d0ba5fb74cfce3a250d927cadcb4a4fc5fc5f8782a6e04d8d95f66622472df62edc564bb77a468418085c1a0642f5faee05d0dd64c7db273e1a9f32175e4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD536eb876f6aa9aa14f16e3ad530c6e6af
SHA1d037b0f311ccf68f862c651277d81d1acbb58301
SHA256e5ef7a8fe8ee62e0b064512d2df8d2ecfd2eba4cf0e9b9c7a4371da53def7621
SHA512be40a73e21a200eccf9fc32fbebaeb42242c877545db57db1e4c2fa8c0eea065bec20e2c5a32556a85aa31ffaacc670a3232377cd80e38695a7ec73b8e49228a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5bf29899194da567f06c8e2127f684ee1
SHA1fd665c97ad197d1cbbaf65011e12739de34fcdfc
SHA256d32d743ff161e7a05dfde2c976d51e8b05f80899a48e63b3150ffb1b115123c9
SHA512db67b0a0cf4ef928721a34ad47b53fa5d638eb0a8293ed10179fc36a7660e1538cc567c3e9e6b98be1df624188e7130b8f0c8a97bc7200d503f4f6ba9b23da31
-
\??\pipe\LOCAL\crashpad_2528_ZINFUDWNGRYFYXJCMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e