Analysis
-
max time kernel
139s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 04:34
Static task
static1
Behavioral task
behavioral1
Sample
77ea057be3674113bddfcff599af727e_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
77ea057be3674113bddfcff599af727e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
77ea057be3674113bddfcff599af727e_JaffaCakes118.html
-
Size
155KB
-
MD5
77ea057be3674113bddfcff599af727e
-
SHA1
3d1fd031ff96f81d5a568bf025034ab1fba98f4c
-
SHA256
60633329ba86a4ce5653e52030b1ecf24a1cdd378484f174ec2412d8fc69a517
-
SHA512
75fed8b08e0d57e01189099fc820e8bca89a20446819bb82d8c449bd973d6b6fbb952a56cd2db871c3c56131096fbc99bce272ab13241fee569899e48951248b
-
SSDEEP
3072:iUE0Ol0O9GyfkMY+BES09JXAnyrZalI+YQ:iK09DsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exepid process 3940 msedge.exe 3940 msedge.exe 2776 msedge.exe 2776 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 4020 msedge.exe 2512 identity_helper.exe 2512 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2776 wrote to memory of 1012 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1012 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 2468 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 3940 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 3940 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 1464 2776 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\77ea057be3674113bddfcff599af727e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc19cc46f8,0x7ffc19cc4708,0x7ffc19cc47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16525699830704954242,13988490867875483202,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,16525699830704954242,13988490867875483202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,16525699830704954242,13988490867875483202,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16525699830704954242,13988490867875483202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16525699830704954242,13988490867875483202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16525699830704954242,13988490867875483202,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16525699830704954242,13988490867875483202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16525699830704954242,13988490867875483202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16525699830704954242,13988490867875483202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16525699830704954242,13988490867875483202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16525699830704954242,13988490867875483202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16525699830704954242,13988490867875483202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD53e587aa193a0970bf526c42083cbacc9
SHA1f41b075bea6ddbfb66113beba8d40f0ba86f5d68
SHA256619b1ab0117d615d9b62bdc800d149a0b132a6d8d2ce76703a6180aa237d5326
SHA512eb4b281aed342655de42d92e5db8abb5c28e13ee62b8ad0f3e9d0082d459b057220466df30ee206a3679e457f9a31bb3174e14c901f540e94207bf5924927f20
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5999c016e7d03382ee14f5c4ae867404f
SHA1bcd33b85409df032aee9fc6ba0fe3c58e31138eb
SHA25612d88a0864dd69b440a920de4c1ff9b922b6ada01d2e02deeab5700334a4c80d
SHA512a2fd047def0053bffcb7adf5fadb326f2f81e48b034f7eeae60e49050aa6e52e76885a5342137c48d7905893e6c64dead8df99c2e8b9a17c998bc705e3e332a7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD558474aaf8d7235b7a9df241cdb3a9596
SHA14392ff5272c90c1e074cfb415ae15c4dec0d7b41
SHA256f3e85ee2d166021d3f7168ba998b5cd5f6f1c44abd2762c8035d1e3449a98baf
SHA5122de3bc350729b52d3c8c8a73224e57b994a140e6648623f3c85586032805b7a92f3f6e897f32f19f9dddd572ecc5e5eb6a46c9701c01cbe1aece54b09487c517
-
\??\pipe\LOCAL\crashpad_2776_GXHJJQFMHGCICKKQMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e