Analysis
-
max time kernel
139s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 17:24
Static task
static1
Behavioral task
behavioral1
Sample
72b4b6f00337ba359e01058bed51efd8_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
72b4b6f00337ba359e01058bed51efd8_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
72b4b6f00337ba359e01058bed51efd8_JaffaCakes118.html
-
Size
155KB
-
MD5
72b4b6f00337ba359e01058bed51efd8
-
SHA1
98b0d9f7eb767f5f85638a47979d479e52eea582
-
SHA256
438343aa6aaa6a02881df89841e30460d2610a18e27dea01a612ee8b602531b4
-
SHA512
c3bf99f4d3315e60a5f710c2400a09df1dc74f23d197c04e6868ea804de3d8ae5520c476c9cd9b7ec3b7294ea87fbb27d05f42d906c95bb6fc08574e56c381ea
-
SSDEEP
1536:iQRTXc5KhAzByLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:i6bYByfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exepid process 3940 msedge.exe 3940 msedge.exe 444 msedge.exe 444 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 4524 identity_helper.exe 4524 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe 444 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 444 wrote to memory of 3432 444 msedge.exe msedge.exe PID 444 wrote to memory of 3432 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 4828 444 msedge.exe msedge.exe PID 444 wrote to memory of 3940 444 msedge.exe msedge.exe PID 444 wrote to memory of 3940 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe PID 444 wrote to memory of 1612 444 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\72b4b6f00337ba359e01058bed51efd8_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fd0746f8,0x7ff8fd074708,0x7ff8fd0747182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4700583443230041433,15709624877309420079,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4700583443230041433,15709624877309420079,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,4700583443230041433,15709624877309420079,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4700583443230041433,15709624877309420079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4700583443230041433,15709624877309420079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4700583443230041433,15709624877309420079,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4700583443230041433,15709624877309420079,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4700583443230041433,15709624877309420079,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4700583443230041433,15709624877309420079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4700583443230041433,15709624877309420079,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4700583443230041433,15709624877309420079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4700583443230041433,15709624877309420079,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5f9bbcf5d2ccffc2d7f64f75850e1b3ad
SHA1ef5470128c77f7be541cd8d9a79b2889ce1a7b54
SHA256a3e6d806781083a5d2cd9921728e7f95a50a93c82887a8bfd6979d6e8280b4ea
SHA51275d2c882a0eddb90110ce3b95ab1762a54d6192be2a04751f9a21f170cae4455d3651bf45a3c31439c0899cf20e4ab92c177d6894f682abb4935581b655c9901
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD53f0710017ea7873162a433382af80e5c
SHA111f28921eeef0c83f57f7816de40b3c45f17e238
SHA256316e8271f0fbf04151a2d494cb61f9b29569f93ba75fcb3b245ab563536d1517
SHA512a9863a7e2c14e701f98dd8b41cfb2d2d59a59eb39fcac6eeb5beb5bb87b4092da266103d963b0f7b1492878295b2ef63de5757a05568dccbd1cb8626e9734923
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD58c59eabce107604a3a13bc50eeff1441
SHA1148104a74ac95d18640a95c57b86219c3ad8bd90
SHA2561c1ae0e1c674d525db9f830ba54fc7ca3844f448ec170f93b68a49258fa2749d
SHA5122337f03ef214d02973a9bdd5a3493f171282dbce65cb460cc16bc6d2531be0da5961a705b3362e60d455d2ff3ac6a1333aad908fe01c68777882c5c6bf945255