Analysis
-
max time kernel
139s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 17:27
Static task
static1
Behavioral task
behavioral1
Sample
6f477a686759d7f4f36b5f97d834c6d7_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6f477a686759d7f4f36b5f97d834c6d7_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6f477a686759d7f4f36b5f97d834c6d7_JaffaCakes118.html
-
Size
157KB
-
MD5
6f477a686759d7f4f36b5f97d834c6d7
-
SHA1
f18b7fbb37b4585d55d3b57fbd99300ec55a519c
-
SHA256
297f81b03e86ab8fa21e4f8b9a60f1f0a699f28dd0fb6178fd0cba69bfd8b7b1
-
SHA512
532250521ae73ee69384c5f45686be0d0bace4798a4070b1b624039f4c299a6cd2fb306370352ebd32642b2bc4b1077c8e63ed27c2324fa055669dc632957089
-
SSDEEP
1536:iURTdV444kIxA4yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:iG+k74yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exepid process 2964 msedge.exe 2964 msedge.exe 1704 msedge.exe 1704 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 2432 identity_helper.exe 2432 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1704 wrote to memory of 2616 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 2616 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 4476 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 2964 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 2964 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe PID 1704 wrote to memory of 3272 1704 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6f477a686759d7f4f36b5f97d834c6d7_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffceba246f8,0x7ffceba24708,0x7ffceba247182⤵PID:2616
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12636154272167281709,6385210601400943324,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:4476
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,12636154272167281709,6385210601400943324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2964 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,12636154272167281709,6385210601400943324,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:82⤵PID:3272
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12636154272167281709,6385210601400943324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:12⤵PID:1688
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12636154272167281709,6385210601400943324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:1064
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12636154272167281709,6385210601400943324,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4876 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4084 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12636154272167281709,6385210601400943324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:82⤵PID:4080
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12636154272167281709,6385210601400943324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2432 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12636154272167281709,6385210601400943324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:12⤵PID:928
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12636154272167281709,6385210601400943324,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:12⤵PID:4808
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12636154272167281709,6385210601400943324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:12⤵PID:2920
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12636154272167281709,6385210601400943324,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:2224
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3216
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA2565009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5676c112a533fdfc894f4d38faa8d451d
SHA1de08207c41498287a9bd68ddd7263f475080e5fe
SHA25670a5f7897b3fb080b0635488cfdd98828389fd03e4a55c24598ddd77642a7aaa
SHA512b327d4aae137a1cc4820056dcaf91b3bdfa27ed490f2445986301d20b8fb7d489616f0b5be12f999d8fabdc33ae2696f18f37bc01ae817398c1ea6a623eea807
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD51a42c0163e075976bdad4904449b271b
SHA1779f621d88154b9e12c569553865f884a761467d
SHA2565755cdf51f13404eb7e02278601b274eb2d524d12392e9d19c09bc91ccf4dac8
SHA512a342f62ba253382b02ec15ffbe9b0d0547626258abb186d9e10a51437f3faa165e4a015d4e846de0fa6d9f442b5d6771f901ae60614ece5a66e21aad303189c7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5f92710dce7cd730d5d6cc7ce0f71527a
SHA109805fc8f566a23269f261fe4d8d49d8e63fad61
SHA25643123778363bb7127cbe720b872f0c60ac212f26646e1317bd0f93ac0f324611
SHA512712bbc7077c56bf5a3039d3fb91ce8f054d8d8983cec1dfd96affa4a45827bf03b60d5aa0992320f66845b349b9ed039ae65886ba2154d74acdcc6a3c0a28a71
-
\??\pipe\LOCAL\crashpad_1704_SQCTUUJNEKCIOZDTMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e