Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 19:04
Static task
static1
Behavioral task
behavioral1
Sample
7682d0d21c83cb237d4d1d5849e089cd_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7682d0d21c83cb237d4d1d5849e089cd_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7682d0d21c83cb237d4d1d5849e089cd_JaffaCakes118.html
-
Size
509KB
-
MD5
7682d0d21c83cb237d4d1d5849e089cd
-
SHA1
094e213c4af9376cb2f9efe29d14c22b1344a304
-
SHA256
fce34cb3770db02bb011528245c34c04124df2700e5cd343f8883eee25c0984f
-
SHA512
a2477610492b4155203f4241208af607f8c39c0e17d7d76d49c8756df8747a523aa693d436d3dc7681ad3e5423d4f1739e23ae3ad7ce1b5ed19ecc7fba0956de
-
SSDEEP
3072:wf+IpBxYUVi9zfs49PwVeL5AmPTmBGM2mqF1H:wf+IpBxv4tLTv
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1032 msedge.exe 1032 msedge.exe 2600 msedge.exe 2600 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe 2600 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2600 wrote to memory of 1308 2600 msedge.exe 83 PID 2600 wrote to memory of 1308 2600 msedge.exe 83 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 2952 2600 msedge.exe 84 PID 2600 wrote to memory of 1032 2600 msedge.exe 85 PID 2600 wrote to memory of 1032 2600 msedge.exe 85 PID 2600 wrote to memory of 2860 2600 msedge.exe 86 PID 2600 wrote to memory of 2860 2600 msedge.exe 86 PID 2600 wrote to memory of 2860 2600 msedge.exe 86 PID 2600 wrote to memory of 2860 2600 msedge.exe 86 PID 2600 wrote to memory of 2860 2600 msedge.exe 86 PID 2600 wrote to memory of 2860 2600 msedge.exe 86 PID 2600 wrote to memory of 2860 2600 msedge.exe 86 PID 2600 wrote to memory of 2860 2600 msedge.exe 86 PID 2600 wrote to memory of 2860 2600 msedge.exe 86 PID 2600 wrote to memory of 2860 2600 msedge.exe 86 PID 2600 wrote to memory of 2860 2600 msedge.exe 86 PID 2600 wrote to memory of 2860 2600 msedge.exe 86 PID 2600 wrote to memory of 2860 2600 msedge.exe 86 PID 2600 wrote to memory of 2860 2600 msedge.exe 86 PID 2600 wrote to memory of 2860 2600 msedge.exe 86 PID 2600 wrote to memory of 2860 2600 msedge.exe 86 PID 2600 wrote to memory of 2860 2600 msedge.exe 86 PID 2600 wrote to memory of 2860 2600 msedge.exe 86 PID 2600 wrote to memory of 2860 2600 msedge.exe 86 PID 2600 wrote to memory of 2860 2600 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7682d0d21c83cb237d4d1d5849e089cd_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c0ef46f8,0x7ff8c0ef4708,0x7ff8c0ef47182⤵PID:1308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,680775184383654934,11289462069307592637,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:2952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,680775184383654934,11289462069307592637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,680775184383654934,11289462069307592637,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:82⤵PID:2860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,680775184383654934,11289462069307592637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:1304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,680775184383654934,11289462069307592637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,680775184383654934,11289462069307592637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:12⤵PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,680775184383654934,11289462069307592637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:12⤵PID:3616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,680775184383654934,11289462069307592637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 /prefetch:82⤵PID:2732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,680775184383654934,11289462069307592637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 /prefetch:82⤵PID:2792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,680775184383654934,11289462069307592637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:12⤵PID:4592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,680775184383654934,11289462069307592637,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:12⤵PID:2880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,680775184383654934,11289462069307592637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:12⤵PID:3560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,680775184383654934,11289462069307592637,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:12⤵PID:1364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,680775184383654934,11289462069307592637,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5892 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2968
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2504
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD5a0a71f1db11a1c63fea8143aea8107f2
SHA11744471be73b588f369c3063b4a0d8e1d3d9b1f1
SHA2564df332754c595c9c7ba06691101eae62b8b980434c8c3f93e94abaf1c3e1f1f0
SHA5125bba32d3f44a505527a2f903a41f016a485066a467a697cfa09eb3d477307b8247ad2f2afcdc3c519577f6c166ea43aa32eb68fd4943ea65c749edbc0bfe8224
-
Filesize
1KB
MD5359413a8e0c205209f2102ba90166661
SHA1c4102f3b8ea1a879001dbe9fc0ee69c445495cd6
SHA256bfc144bbb5b3fbed861fb4a2af730633ef60ef3a0472a574a7197b866806bceb
SHA512da9e055056851f44254bab0b7922ecca353797096786db9ef6bbb5f959c9d1fcd275f508843cad521f65851c43bef64a7a96432392bbfa24bf953b815a400c0c
-
Filesize
5KB
MD51754be18cdce3e39b681c2dd10917445
SHA11be1ac0b83c387ae398e7f5b803de09233431912
SHA256fc4497833c6e17082542652eb205bbeae41f63aeb4927a9bd18ef08121f2376b
SHA512f3043537d1f2a058e1d283202c3a1474e80b90a9d32d26e7c8a4cdbf1e382ef372496c331d8bede00e86d46663b854a0ee0502e0b54982a8cb7883d6e88eb60a
-
Filesize
6KB
MD5f47edc779a5be0d57f0bf6551b6304fd
SHA16ffdd6bca8ee959568adaf03011327818c3a5554
SHA2566563293c0734cb381968bf6d5a60638439580e28bcc738f238cacb927e372254
SHA51236ba43877f12c54d0e4d18c36a99c9fa4dde0df9c1d55a4fb3a1e3bc590c310b82f4c67e60d0de25788475b9248f8f780f4dfa51e81dd77365cac405c3abb234
-
Filesize
7KB
MD5a27b3f568b5fb62c8e2dfd0d35860ae8
SHA14aa6c3c43e242a1f551b7a4852f1a7849b9931dc
SHA2564e090a7f9f3beaf3a7c85efbcee1847392f7c6371feff4fae9733347502140fd
SHA512c26814f1611d2cb3388e8e5c04eff383c438d1e3a7785a6ce28c7000dc69a4a6541670bca271dedd007cd5e7cdcb74f1ff5c0fcbcf77e0d074e455eed81a9974
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD57f832fb096cad5bbbfb3aff3cba4231f
SHA1893900fb8d278e3cfb28dfe7d5d232074540303e
SHA256139e120e9a32d9909d186680b343d6dfe965aad1358c8ac98dbfc2cd5fedea8b
SHA51280083747372ec5cb4818637d3dc5aa2405970bf673e29dcab613192c67dcc8d618549a80493e1bdf52e07609ca10413b14534c5e52d8387f386cce335573982a