Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 10:42
Static task
static1
Behavioral task
behavioral1
Sample
7537daaddc81dc26da880a76b4053067_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7537daaddc81dc26da880a76b4053067_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7537daaddc81dc26da880a76b4053067_JaffaCakes118.html
-
Size
214KB
-
MD5
7537daaddc81dc26da880a76b4053067
-
SHA1
5797cfd66cb18f093f2079464f37539b74db00ab
-
SHA256
19a77f813e4b2cc83517f663bdc3c70460bed3c90afa2a4b9910d5021c3fd1f8
-
SHA512
f92ac743b52a9f5e8810342da0bb88923c7c3bee7298bec9ff91d77b841dc03aea177cb55a36e863fb49116358585b27d226fcd9d8f8ddcde9c0ffd33bea64eb
-
SSDEEP
3072:ArhB9CyHxX7Be7iAvtLPbAwuBNKifXTJv:Yz9VxLY7iAVLTBQJlv
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2304 msedge.exe 2304 msedge.exe 3540 msedge.exe 3540 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3540 msedge.exe 3540 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3540 wrote to memory of 3200 3540 msedge.exe 84 PID 3540 wrote to memory of 3200 3540 msedge.exe 84 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 2304 3540 msedge.exe 86 PID 3540 wrote to memory of 2304 3540 msedge.exe 86 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7537daaddc81dc26da880a76b4053067_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc374346f8,0x7ffc37434708,0x7ffc374347182⤵PID:3200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16279178024414880868,17190473065090586872,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:4836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,16279178024414880868,17190473065090586872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,16279178024414880868,17190473065090586872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:82⤵PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16279178024414880868,17190473065090586872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16279178024414880868,17190473065090586872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16279178024414880868,17190473065090586872,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1944 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:884
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1684
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52daa93382bba07cbc40af372d30ec576
SHA1c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA2561826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA51265635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
-
Filesize
152B
MD5ecdc2754d7d2ae862272153aa9b9ca6e
SHA1c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
-
Filesize
5KB
MD5b318fb1e7f91275598d40e003e0322f5
SHA128dd85b7cc9383b7ab8308a2a9649202a863336a
SHA2563cb3a7e468847ee3134342436f281a03db69824849261480faf202a0a6028613
SHA512e1d6fa9adf0941fdb5abfe4454db95c687248d99103b395be11f3bd89a37a5b6ec74b53b5384b78a3a09e0db5ad9f11477a48885a3c49d88cf0fca5480e63c25
-
Filesize
6KB
MD5bc557a4f649f815fe9fb55da3ce44202
SHA1ba4643bbd633ee558de4240efe742e076602c809
SHA256dc92befa88bc34e87904f53b2cf24722c38a707a8c4b67347d69f1b652408233
SHA5124b5db162a062ee3ce38dfdc3b1f1f296a477f7562461f56af420573dc805a2ff4d75e6f6c7808083af16e4020e187a483281cf8ae2f1468968669ea67ba5d20c
-
Filesize
11KB
MD5fd586209f175835f0d7480624daabdf0
SHA12f6aa79219edece395976dae617358b7226f39e0
SHA25635fd7ed6089677249c73f83104f6510572aeda7c4ec4654e1c5267ab9930926a
SHA512311f0ebc96199f8f7509f139ba30bc091f2459d29141e35e900dcd7d40bb0fccf147251b4d60e6266591884324b298f58bb0b32486c33f5f73df6ce3da7600ac