Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 14:00
Static task
static1
Behavioral task
behavioral1
Sample
7955f123b890313dfec51783f0882351_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7955f123b890313dfec51783f0882351_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7955f123b890313dfec51783f0882351_JaffaCakes118.html
-
Size
158KB
-
MD5
7955f123b890313dfec51783f0882351
-
SHA1
ac7f20fd34da4532e45012a662a7997e96aea1dd
-
SHA256
5051e67d71cb043177883fcce9368f90efc47edc4eb911f91d6cc8d17709734d
-
SHA512
a106b18b4180fa4c7c7a0761076c84c9ef121be860ee17cff6759065add78be083ae990ba40359a8cfbcbcd24934a5b713272b2c39e3007d053d9ad3cbd014de
-
SSDEEP
3072:iEr7fv3+oyfkMY+BES09JXAnyrZalI+YQ:iAv3+lsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exemsedge.exepid process 4648 msedge.exe 4648 msedge.exe 3244 msedge.exe 3244 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
msedge.exepid process 3244 msedge.exe 3244 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3244 wrote to memory of 2784 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 2784 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3280 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 4648 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 4648 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe PID 3244 wrote to memory of 3692 3244 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7955f123b890313dfec51783f0882351_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9303d46f8,0x7ff9303d4708,0x7ff9303d47182⤵PID:2784
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3169423453559278331,2201958242882447733,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:22⤵PID:3280
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,3169423453559278331,2201958242882447733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4648 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,3169423453559278331,2201958242882447733,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:82⤵PID:3692
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3169423453559278331,2201958242882447733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:1640
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3169423453559278331,2201958242882447733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3984
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3169423453559278331,2201958242882447733,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1320 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5080
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4720
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5537815e7cc5c694912ac0308147852e4
SHA12ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA51263969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
-
Filesize
152B
MD58b167567021ccb1a9fdf073fa9112ef0
SHA13baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA25626764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
-
Filesize
5KB
MD52194f4c210f7d71614d8ade81443d52b
SHA180d1737467c28698d78823597d90e87bd1c969f3
SHA25636c1363e0690eb85209a0ff2500079e16a72ba62d40a6deb82d359a0d0ebb121
SHA5120040434459662a6d75373a42619feaec4a615ba3b9ed8b3e0b6cb7ff0d000d09fcfd171c5434b286f724c3c489f91f47eb773dfb64bfa8584dd9a6a4650e5d6c
-
Filesize
6KB
MD54040c5eb4ad00024c472de40f0f8f01b
SHA111fe603a0060b8efd9629d700b6b209c281c72a5
SHA256a9f78d73fc39f525fe2cd31e4cfa7a61a0add0cee7d60115fa9acb092677b5aa
SHA5125d149c0b1f0046b094604b7a206930e77e8efd2a2a521bf604ec4b3ba10e27080fdb0047793bb27b3f4015dc4c0983c43260991fa99b9faa79817dce1b239271
-
Filesize
10KB
MD51b5dd83ca708e32e34dbe6f383203659
SHA1b3b617664f05c77541572359ac8153f8bb0e442e
SHA256ec814d3a12fb5ed4a7619cb8932230eeba1b0bee87633986ad0fb352a35a5cd0
SHA512b726a878e7396fc35fc6f20aa1ad115f5b405a1298b83c10ae4f90aefdb3222a980f3758b33836f3c02c0e77d818f595c4a309bd087c64b44dc09d343d038e7d
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e