Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 03:17
Static task
static1
Behavioral task
behavioral1
Sample
742b82fe30d1bdbc2326352da5d2563c_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
742b82fe30d1bdbc2326352da5d2563c_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
742b82fe30d1bdbc2326352da5d2563c_JaffaCakes118.html
-
Size
138KB
-
MD5
742b82fe30d1bdbc2326352da5d2563c
-
SHA1
1de59586b6bd9ea5fa69269a1eb1acd296086a58
-
SHA256
e88e3e4457a357968358cf182d2541b92973a6adc156a095597701515dae7e3d
-
SHA512
ccb335285a675d60068728f179b4d38cc9a1726f190005d95648b162843b9c75fc392263ba9aefdd583ddfcce48e2b2722ba9eddc9fae8f8377393e31ff14d1e
-
SSDEEP
3072:SGsVUaRlbGdEyfkMY+BES09JXAnyrZalI+YQ:SGsVUaRlbCJsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2976 msedge.exe 2976 msedge.exe 2456 msedge.exe 2456 msedge.exe 532 msedge.exe 532 msedge.exe 532 msedge.exe 532 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2456 msedge.exe 2456 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2456 wrote to memory of 1680 2456 msedge.exe 85 PID 2456 wrote to memory of 1680 2456 msedge.exe 85 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 812 2456 msedge.exe 88 PID 2456 wrote to memory of 2976 2456 msedge.exe 89 PID 2456 wrote to memory of 2976 2456 msedge.exe 89 PID 2456 wrote to memory of 3032 2456 msedge.exe 90 PID 2456 wrote to memory of 3032 2456 msedge.exe 90 PID 2456 wrote to memory of 3032 2456 msedge.exe 90 PID 2456 wrote to memory of 3032 2456 msedge.exe 90 PID 2456 wrote to memory of 3032 2456 msedge.exe 90 PID 2456 wrote to memory of 3032 2456 msedge.exe 90 PID 2456 wrote to memory of 3032 2456 msedge.exe 90 PID 2456 wrote to memory of 3032 2456 msedge.exe 90 PID 2456 wrote to memory of 3032 2456 msedge.exe 90 PID 2456 wrote to memory of 3032 2456 msedge.exe 90 PID 2456 wrote to memory of 3032 2456 msedge.exe 90 PID 2456 wrote to memory of 3032 2456 msedge.exe 90 PID 2456 wrote to memory of 3032 2456 msedge.exe 90 PID 2456 wrote to memory of 3032 2456 msedge.exe 90 PID 2456 wrote to memory of 3032 2456 msedge.exe 90 PID 2456 wrote to memory of 3032 2456 msedge.exe 90 PID 2456 wrote to memory of 3032 2456 msedge.exe 90 PID 2456 wrote to memory of 3032 2456 msedge.exe 90 PID 2456 wrote to memory of 3032 2456 msedge.exe 90 PID 2456 wrote to memory of 3032 2456 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\742b82fe30d1bdbc2326352da5d2563c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaef7f46f8,0x7ffaef7f4708,0x7ffaef7f47182⤵PID:1680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,11990793235410601466,1799377858744145051,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,11990793235410601466,1799377858744145051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,11990793235410601466,1799377858744145051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:82⤵PID:3032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,11990793235410601466,1799377858744145051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,11990793235410601466,1799377858744145051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,11990793235410601466,1799377858744145051,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:532
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3632
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2084
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA2565009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
-
Filesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
Filesize
6KB
MD513ef530483d81e157cd3601978f56058
SHA1c3c62ace9b7f66944a54b404873bab06c573d307
SHA2567f2c2030ab8f8411cc6cac39ec3dc41f12cc2aaf84e8961d37bd3c511b8c3411
SHA51249baf04d8df7371f791964559cd82a05455eddd7017ca4fa5731ccbbf03990af3ee32df00fb927559b4f52e2e40dd4292652fc1c0dc4c5843df8347f139df50c
-
Filesize
6KB
MD5b402e34d9b8c80e31d8b5ba62a4370db
SHA10d59dcec7f7da900b330386d713e8b3200889536
SHA2569a4795ca880ade255764df6743182b9f72456d2fdd714c3986c9b3f28abde11f
SHA512f57145ab8174b55f17c5a49ae46afc413126c11be84c10d79cba3da3ec866bcf5b09e52e8b3ccb6533e94a7f2b487cec9839b35146961c0846d1667562af9424
-
Filesize
11KB
MD576282fa5dd9f9edd1eaaa7d2c6d9a25f
SHA1b2372b2244d20c7774e1a63a9cd1e1447c5e6271
SHA256bbaed2bc416328e9e5e734fe601a2edee0fe8fc21a83ba7cfed9eb4e5f73c907
SHA512c5ae843919ecd39329b73d17e29abe5d12831d5e680dc3528eb85d0344bef1b43f8b18bd6c6c0f2d25d29c12c0911f55b5a37c736fcdb225274c8c68d61c38b6