Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 00:38
Static task
static1
Behavioral task
behavioral1
Sample
704f0fd06b6ef19ef84928be045b4f50_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
704f0fd06b6ef19ef84928be045b4f50_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
704f0fd06b6ef19ef84928be045b4f50_JaffaCakes118.html
-
Size
139KB
-
MD5
704f0fd06b6ef19ef84928be045b4f50
-
SHA1
2cda39610e4a4903e2a06c61ba7ad04920b32d70
-
SHA256
5d35a83de9f9893dd81c00b44530730cd7c978b6dbb74c22ffe3e3b08b79b223
-
SHA512
8f7f94faf7fa278b6ee594b4e5b1d46b928d99786d3c580a94c755181ee7519e28b3d877e219f498cfb37317c15e089e3db1f173cf6d06f05927ee515869e4e3
-
SSDEEP
1536:Sppdr8llinqiWyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:SpL8sqiWyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4040 msedge.exe 4040 msedge.exe 2644 msedge.exe 2644 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2644 msedge.exe 2644 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 4512 2644 msedge.exe 82 PID 2644 wrote to memory of 4512 2644 msedge.exe 82 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 1176 2644 msedge.exe 83 PID 2644 wrote to memory of 4040 2644 msedge.exe 84 PID 2644 wrote to memory of 4040 2644 msedge.exe 84 PID 2644 wrote to memory of 4728 2644 msedge.exe 85 PID 2644 wrote to memory of 4728 2644 msedge.exe 85 PID 2644 wrote to memory of 4728 2644 msedge.exe 85 PID 2644 wrote to memory of 4728 2644 msedge.exe 85 PID 2644 wrote to memory of 4728 2644 msedge.exe 85 PID 2644 wrote to memory of 4728 2644 msedge.exe 85 PID 2644 wrote to memory of 4728 2644 msedge.exe 85 PID 2644 wrote to memory of 4728 2644 msedge.exe 85 PID 2644 wrote to memory of 4728 2644 msedge.exe 85 PID 2644 wrote to memory of 4728 2644 msedge.exe 85 PID 2644 wrote to memory of 4728 2644 msedge.exe 85 PID 2644 wrote to memory of 4728 2644 msedge.exe 85 PID 2644 wrote to memory of 4728 2644 msedge.exe 85 PID 2644 wrote to memory of 4728 2644 msedge.exe 85 PID 2644 wrote to memory of 4728 2644 msedge.exe 85 PID 2644 wrote to memory of 4728 2644 msedge.exe 85 PID 2644 wrote to memory of 4728 2644 msedge.exe 85 PID 2644 wrote to memory of 4728 2644 msedge.exe 85 PID 2644 wrote to memory of 4728 2644 msedge.exe 85 PID 2644 wrote to memory of 4728 2644 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\704f0fd06b6ef19ef84928be045b4f50_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9924846f8,0x7ff992484708,0x7ff9924847182⤵PID:4512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,16024178481456036426,1306992766988140709,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵PID:1176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,16024178481456036426,1306992766988140709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,16024178481456036426,1306992766988140709,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:82⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,16024178481456036426,1306992766988140709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:1220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,16024178481456036426,1306992766988140709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,16024178481456036426,1306992766988140709,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4636 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1044
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4204
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
5KB
MD5eb5ec72628cfea0fd29cda7285d42c9f
SHA188d9f90c54dcd5f9952c822eaeb19595d4817af4
SHA256ccd9060ac37029cdd6bd2ce5fc3b4e341cb1dd8627009b840a551119ab9e2277
SHA512444df5d53dc88ec6b6188a9529c9bb26b4b5738efeec842f50ed47dfe469434138b5138da58c8d9aa7a983b3a871b09cccde7c2a94f6461bb3f31cf7f85b065b
-
Filesize
6KB
MD5cc518321296c636b322ce14b4c2f32de
SHA18f25089f8e1e0d9db4bf9a623cac51ac53f4630a
SHA2566530495fc42724902986ca481a9dc679330cf35ad443e6208e1ff36f2b3d7878
SHA512e186d92e22cc33ee9f80ef4c6229b457e7b0c259d05834034f08f3d1a11020bdb417483a7582b56bc0d1b988e648c0e9f6ce99d341bbfb4344e50dfeceb955eb
-
Filesize
11KB
MD55bac88c8965e5294bf86e16cbaec14fb
SHA1b697f410d4bcba0d66d3d23436937655123c1329
SHA256ff054d68acc702dc76ded12c516fb789cbc14afbdb21bc6da2b69e8c9de32a1c
SHA512bb7c2937ec8f465879f090e4eda30d567a6713c1d124a2ba9563e53534106f8848e91a82ed155c0e789dda09642986ef0cad79cc830388d3fe51fe9cde4cfe5f