Analysis
-
max time kernel
48s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 11:47
Static task
static1
Behavioral task
behavioral1
Sample
7560a59168aa800bea876d951b33ea08_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7560a59168aa800bea876d951b33ea08_JaffaCakes118.html
Resource
win10v2004-20240426-en
Errors
General
-
Target
7560a59168aa800bea876d951b33ea08_JaffaCakes118.html
-
Size
46KB
-
MD5
7560a59168aa800bea876d951b33ea08
-
SHA1
d0d67ba86079136a64c7625fd9a79a431762066a
-
SHA256
9e6666327c7f1ede8abf19cd6d6b001d0191dfb89ddb10384a44c356374fdcee
-
SHA512
68d65bad13d52a8c7b7c83262cd9347f91d02b9efd518334bf5349c36600202d761ea8ed0a7cca66a0a27e369f62e865fef5bb21511debee493467ce09a63404
-
SSDEEP
768:9rKapHvvCIooNXI3QVuMz7t7ppqv/6HdNNgV99:9DHv7oiXIyRz766HdK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1348 msedge.exe 1348 msedge.exe 1872 msedge.exe 1872 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1872 wrote to memory of 1792 1872 msedge.exe 82 PID 1872 wrote to memory of 1792 1872 msedge.exe 82 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 4508 1872 msedge.exe 83 PID 1872 wrote to memory of 1348 1872 msedge.exe 84 PID 1872 wrote to memory of 1348 1872 msedge.exe 84 PID 1872 wrote to memory of 4700 1872 msedge.exe 85 PID 1872 wrote to memory of 4700 1872 msedge.exe 85 PID 1872 wrote to memory of 4700 1872 msedge.exe 85 PID 1872 wrote to memory of 4700 1872 msedge.exe 85 PID 1872 wrote to memory of 4700 1872 msedge.exe 85 PID 1872 wrote to memory of 4700 1872 msedge.exe 85 PID 1872 wrote to memory of 4700 1872 msedge.exe 85 PID 1872 wrote to memory of 4700 1872 msedge.exe 85 PID 1872 wrote to memory of 4700 1872 msedge.exe 85 PID 1872 wrote to memory of 4700 1872 msedge.exe 85 PID 1872 wrote to memory of 4700 1872 msedge.exe 85 PID 1872 wrote to memory of 4700 1872 msedge.exe 85 PID 1872 wrote to memory of 4700 1872 msedge.exe 85 PID 1872 wrote to memory of 4700 1872 msedge.exe 85 PID 1872 wrote to memory of 4700 1872 msedge.exe 85 PID 1872 wrote to memory of 4700 1872 msedge.exe 85 PID 1872 wrote to memory of 4700 1872 msedge.exe 85 PID 1872 wrote to memory of 4700 1872 msedge.exe 85 PID 1872 wrote to memory of 4700 1872 msedge.exe 85 PID 1872 wrote to memory of 4700 1872 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7560a59168aa800bea876d951b33ea08_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6ed746f8,0x7ffe6ed74708,0x7ffe6ed747182⤵PID:1792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,13917160428459048386,2852423639570089811,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:4508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,13917160428459048386,2852423639570089811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,13917160428459048386,2852423639570089811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:82⤵PID:4700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13917160428459048386,2852423639570089811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13917160428459048386,2852423639570089811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:1216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13917160428459048386,2852423639570089811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:12⤵PID:3836
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2040
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
Filesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD5f6e89212df5525ff745f5fca7054cf30
SHA1b96cb8a69e7b928dfc2ec660166052a1987ead98
SHA256725163ae34a4ea8acce533070cf52d81c63c8b0242f19ac2c03f849648094e82
SHA512d502c1248124de68a7baf129ff376650a44165f640af17db1e2bfba85af4eaa0445972e1fb9268b785e7151c4dca052f6f28812eee6e537fa3d510b1cdabfab9
-
Filesize
6KB
MD58e2c521d9debfb12f5e1a65d044b5615
SHA14fe214b9cb20b4e0ea6d073a32768dbbcc638c0b
SHA256927b46f9f6e2cd4e90a0968b368098cde52c48e344f895c5598d2b8ad070f82b
SHA5129b07598f8e95a3bd8905ec312572512daca0839039682ed001f637f8b57e3c8fd3484f73f16b97976d913a07b5eaf7ab60d1eedab12804a69c3bf526eae6eb6b
-
Filesize
5KB
MD5ebdfae9f23f7bf0f6a23330accce03d6
SHA1c0a176a4d78d087a81f285bcd0346296bfa03fc2
SHA256a6da700f3b0d60aa4597eb981f19938ee02f3d7155e8e6530196e90b4d426a58
SHA512a188aa5e95480d949a192a5ba51e01f5a5e4af94fdf0ecdac7c6b0baecf382fd4dded1a5799ebc371b6652af4d2cb2e11344568db24d89653b9804ca083807c4
-
Filesize
11KB
MD55fb80ae3666e0ca0c9e13b8db99449f9
SHA1e6a3355d69d83b344fc5b1aa12d22e18760631fd
SHA2564f2ad29c65e440fd29fa0203ea8e2df8d5ddb9722e5c5dbb47c7e99c5162913f
SHA512abb7cca7ce4725a9fdb8dddbb35d271c89e868916464fa85e79ee74d687001ec43a7b4989c48461a1a6e53c7c0479d4be189327196222c440d940062401f9766