Analysis
-
max time kernel
140s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 04:52
Static task
static1
Behavioral task
behavioral1
Sample
746059d4695ca90f26c7be7e58002312_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
746059d4695ca90f26c7be7e58002312_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
746059d4695ca90f26c7be7e58002312_JaffaCakes118.html
-
Size
681KB
-
MD5
746059d4695ca90f26c7be7e58002312
-
SHA1
d28f7795bf5d352cd826c9d6cea12b178ef3daae
-
SHA256
9ad084cc670af4ed23cd7370af2b71c8abbad3b63c1250790c279f234a48c3d8
-
SHA512
62e979610861c54cd17d5a2d698c181919bdb9af5f29f55406fe6a48744430d5d3f169c2de69fade2f61c71cff161f50219f94d5578596ebdd63afcdd792abad
-
SSDEEP
12288:d5d+X3kCdlDG5d+X3kCdlDH5d+X3kCdlDC:h+ECdm+ECdV+ECdk
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exepid process 4716 msedge.exe 4716 msedge.exe 1988 msedge.exe 1988 msedge.exe 3580 msedge.exe 3580 msedge.exe 3580 msedge.exe 3580 msedge.exe 2956 identity_helper.exe 2956 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1988 wrote to memory of 1604 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 1604 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 3052 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4716 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4716 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe PID 1988 wrote to memory of 4492 1988 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\746059d4695ca90f26c7be7e58002312_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff631e46f8,0x7fff631e4708,0x7fff631e47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,8511539567805112826,7968280233373038849,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,8511539567805112826,7968280233373038849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,8511539567805112826,7968280233373038849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8511539567805112826,7968280233373038849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8511539567805112826,7968280233373038849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,8511539567805112826,7968280233373038849,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4936 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,8511539567805112826,7968280233373038849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,8511539567805112826,7968280233373038849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8511539567805112826,7968280233373038849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8511539567805112826,7968280233373038849,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8511539567805112826,7968280233373038849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8511539567805112826,7968280233373038849,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD56cf5220fb7c6711cbdc67c8e855aa40c
SHA1a0b8ac1a85f4b8a279573d00dcf3f1e9d6f5a60a
SHA2560e390817703ce445cf5323d49268dbbc5bfb76ae64d4cda819d48c26ee95cd25
SHA512ab2b8dbadadbb811dc3ed840fa3285b6e2fde04cd97ca65b380e45abce5de97367cecc2a978004e17370271bf109aacc345eeccaa4a2714fff6599e1c86f8bd3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5e6f7e347fa3c93481c4f99df0f97c074
SHA1d121ee9672a206c3482dae04bc3586c9bcb84ffb
SHA256f42abfd1057874e015f0fa63fbddeb9808ddeec9f7da8c50144045e55272a156
SHA5121ddbc59e423bd9cc7cdf75bfe7a90b6fc3629192173065bdd21908fb005310b9069a52f364c613a9ebf59785f00ae3cb78b5a58e7643a7db4c30dbf14ab5577e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5a49e62379770b45d4cd099380a4a29ea
SHA1776a0c89129a1dc520c59e5cfd91e94b70a34b38
SHA256b6da3c7a86e5a29141a98f126e54e42fecc6163c8e081061f2d1aa962355382f
SHA5124f2b58d2826589808e223a2be316299f8f4d89fe6b9a3110a494d87a2f52aaa752b423a27c2dd68e5c5d94a1c55314404db0a808cbafb05a5eef7a0bfbc1723a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5c9e33633031139bef37ab62eb6a12c0e
SHA172e2aa982002ced5edcb2261c37ca29f6b34d601
SHA256dcec58a2a41be759fd07dac053be55c06bf7a2836245778de4cb172000000b08
SHA5123a616f0913c23d6f5e96eed1ea07a3eb28c016025f5297abcc75944a88b03ba7e518d4f88b3a5af96311f78be9fc579b9233ed6916efaba2b7278a424e78f3e0
-
\??\pipe\LOCAL\crashpad_1988_CIRHBYVSJLCBTBFMMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e