Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 12:21
Static task
static1
Behavioral task
behavioral1
Sample
6e80453b7be848ec498eca67e52ef542_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6e80453b7be848ec498eca67e52ef542_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6e80453b7be848ec498eca67e52ef542_JaffaCakes118.html
-
Size
128KB
-
MD5
6e80453b7be848ec498eca67e52ef542
-
SHA1
185ce491da33ced0b2667114b7cfc4da62e66c4b
-
SHA256
893b2e6a0c8100bd251cf7a526c2ce006937525c3095bf238826aa5565bd6ae9
-
SHA512
65bd496f88394a4163f35f5c668132766b569bcb0bee003c60b05edd5c1fdd2b81623c90a539484f9597bf451ab6c3d0015911fb20f94844db920055bb027881
-
SSDEEP
1536:SVv7rKoPyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy+:SQoPyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exemsedge.exepid process 768 msedge.exe 768 msedge.exe 2664 msedge.exe 2664 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
msedge.exepid process 2664 msedge.exe 2664 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2664 wrote to memory of 3208 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3208 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 1444 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 768 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 768 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe PID 2664 wrote to memory of 3432 2664 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6e80453b7be848ec498eca67e52ef542_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e77046f8,0x7ff8e7704708,0x7ff8e77047182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9549798869203773377,15266384760849878154,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,9549798869203773377,15266384760849878154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,9549798869203773377,15266384760849878154,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9549798869203773377,15266384760849878154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9549798869203773377,15266384760849878154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9549798869203773377,15266384760849878154,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2344 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD564a174be86ff1618fa955e5cb3278106
SHA15e610ccc84141e2eca77c8b90c9a715cd7299ad6
SHA25641d50483e607e5f19dc9a7d3521d5fc6b93a8a422f7ee87c0a185bb242ba6616
SHA512d919d04d63d2af5d7cdfc652b1939a4e53491cd5ee4f83b0b04abe93a16920fe20b013730e5b38c941d400329db49d6b22e365df1a13f5378c64a9f8332318b1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD54dfed4204255a7b96401ad67cde1e149
SHA10c9a19abf685ce1db14bd38b579983abcef5c51b
SHA256504ba0897c0f4bc294b6f9e4b3909f7776ab5cf1e49400d6609e7646c7a0b993
SHA51217018971be9a8f68c8ecd9582af2f4339d636d7789821f8cf0e872a67277a2e29aa782677059cea36bf810ad71d8eb5ac5f313f488cf1ae506dcef3179f9462c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD585b369c8cd67905993818ad523b0f71e
SHA1c713fd8b9360df84d7a28e03df3c8a8f13e81b27
SHA256198e8f737f456c795cdd884ee98e1c66ecdc0bd1c9d9c8943ca0fcc14d41bb4b
SHA5124efbd89f57e0cbd4b9d059c44253c4b93e2f4507f43fa73ab68eb454577d5135a1bb454e82fc401021a565a68a0a682a8935eea603088b2f795c40d0d9a3122e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5c900b09037b7e15f8a2ecc3133921963
SHA1b3dcd22c064317587fddad5131bb35e879b8d900
SHA256d3cb61c99d46cf346f996a6b88fc1e498df95938232aea1fdda4a7d97076851f
SHA5129bf2e5ac1dbb5d0fe964d38e4cea5852be084783f9c31079d5d720c379555e6454471edea1b5697baa004f5ca01ff54c8e94e93f2e275ed2ec70dd2e08aa9751
-
\??\pipe\LOCAL\crashpad_2664_PDNOICGSEMKBOKAKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e