Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 17:59
Static task
static1
Behavioral task
behavioral1
Sample
765418f79f8362a086f0c19634da12a1_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
765418f79f8362a086f0c19634da12a1_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
765418f79f8362a086f0c19634da12a1_JaffaCakes118.html
-
Size
346KB
-
MD5
765418f79f8362a086f0c19634da12a1
-
SHA1
0b4b8491f9f4b16681b83b7aa0e519f92c62e1a6
-
SHA256
c99e0c0aeb0f4f3a19a845f233676caae2195ddb63459b7dfb7f56bc29b85d1a
-
SHA512
3fd039709b898eccb6d00450aaa4377ebb7a0d7856c1759df2db644ee690bc7a21c4e1307fb9579c79238299a849209a88e3f7ee88354008743da44549c9ed37
-
SSDEEP
6144:ysMYod+X3oI+YLhEsMYod+X3oI+Y5sMYod+X3oI+YQ:w5d+X3m5d+X3f5d+X3+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2676 msedge.exe 2676 msedge.exe 4868 msedge.exe 4868 msedge.exe 5020 identity_helper.exe 5020 identity_helper.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4868 wrote to memory of 1700 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 1700 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 2676 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 2676 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3720 4868 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\765418f79f8362a086f0c19634da12a1_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffca1246f8,0x7fffca124708,0x7fffca1247182⤵PID:1700
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13040343288074407138,16582981336247929273,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:3864
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,13040343288074407138,16582981336247929273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2676 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,13040343288074407138,16582981336247929273,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:82⤵PID:3720
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13040343288074407138,16582981336247929273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2632
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13040343288074407138,16582981336247929273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:2940
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13040343288074407138,16582981336247929273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:82⤵PID:3188
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13040343288074407138,16582981336247929273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5020 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13040343288074407138,16582981336247929273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:12⤵PID:1648
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13040343288074407138,16582981336247929273,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:12⤵PID:4700
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13040343288074407138,16582981336247929273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:12⤵PID:4400
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13040343288074407138,16582981336247929273,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵PID:4924
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13040343288074407138,16582981336247929273,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5520 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1660
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4884
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD56dcc479e8ae189d15f84657d8726c107
SHA17ebe38f9c939815da71beb5c27b93690f58495df
SHA256101de73bb1d113376182e5de02584d195e1b66702362d450785af4319d3e5ee8
SHA512bf096f1fe87b9d64110afdc9029d8ac75bd29946bc06fbf6f7e234f14509a23811b7c3429bcf7f667d7956aa3f46c89bfffec0988d052d4ccf773dfb13e00b70
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD53e29f9f35150e69e062ce59082cf5adc
SHA15b9f360da82f42fe06f07f0f3526b7472bcbea41
SHA25699983f4c7a75bf660dfcd41f7cbc7287ac71d5413852dc07965739bf259db200
SHA51220eaef5324623e70013853870590ee1a31bfac7c4210ab19e92e311655330b36b1a1b910842a5df14f49c0b3201a4ae45c687467fe624abff18afeb8c75397b1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD58d4970df70aa8fbe92ae7b884d00f6f4
SHA1043a70f5fd154cc29e8a02abd90f3d1935d8c07d
SHA25675e63d905a79129153303fa1e2505a87e7b4f28be906c7516a53479a2db86afe
SHA512383c1d4f8f5c9cdc7a3d1af06a47fa02b61ad40a75f9c11aeb4794f10de3c5bfa31b0d5b4f4501050e80891cc721665678a092e3b2f16e2b46837837ced8d24b
-
\??\pipe\LOCAL\crashpad_4868_RLHHWKKHKJKGKMYNMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e