Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 18:39
Static task
static1
Behavioral task
behavioral1
Sample
7a1f54c81487cd916e9e5ec7c56f7d63_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7a1f54c81487cd916e9e5ec7c56f7d63_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7a1f54c81487cd916e9e5ec7c56f7d63_JaffaCakes118.html
-
Size
36KB
-
MD5
7a1f54c81487cd916e9e5ec7c56f7d63
-
SHA1
8dd2ccb3809267df16d762e160d947d83f0b6a93
-
SHA256
6c39426d4e0eeee571160de8fc1c4db92cfeb6adf2c3850dff1963e277b298da
-
SHA512
fc24a6f3466ede3110348e08befb86fd7879e0f103664d97b1b5dd342e7674cc9a44e8333a4e911e6543d42317d9d33d41cf94729cf01580fbe9ea16ed8e8de6
-
SSDEEP
768:eA3raIQjuHC/MAdQmdT0nkozamEtfPuG+lunc:eA3raIQjui/xdjdT0nkozamEtfPuG+l1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5040 msedge.exe 5040 msedge.exe 3212 msedge.exe 3212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 3596 identity_helper.exe 3596 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3212 wrote to memory of 1036 3212 msedge.exe 82 PID 3212 wrote to memory of 1036 3212 msedge.exe 82 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 2116 3212 msedge.exe 83 PID 3212 wrote to memory of 5040 3212 msedge.exe 84 PID 3212 wrote to memory of 5040 3212 msedge.exe 84 PID 3212 wrote to memory of 1736 3212 msedge.exe 85 PID 3212 wrote to memory of 1736 3212 msedge.exe 85 PID 3212 wrote to memory of 1736 3212 msedge.exe 85 PID 3212 wrote to memory of 1736 3212 msedge.exe 85 PID 3212 wrote to memory of 1736 3212 msedge.exe 85 PID 3212 wrote to memory of 1736 3212 msedge.exe 85 PID 3212 wrote to memory of 1736 3212 msedge.exe 85 PID 3212 wrote to memory of 1736 3212 msedge.exe 85 PID 3212 wrote to memory of 1736 3212 msedge.exe 85 PID 3212 wrote to memory of 1736 3212 msedge.exe 85 PID 3212 wrote to memory of 1736 3212 msedge.exe 85 PID 3212 wrote to memory of 1736 3212 msedge.exe 85 PID 3212 wrote to memory of 1736 3212 msedge.exe 85 PID 3212 wrote to memory of 1736 3212 msedge.exe 85 PID 3212 wrote to memory of 1736 3212 msedge.exe 85 PID 3212 wrote to memory of 1736 3212 msedge.exe 85 PID 3212 wrote to memory of 1736 3212 msedge.exe 85 PID 3212 wrote to memory of 1736 3212 msedge.exe 85 PID 3212 wrote to memory of 1736 3212 msedge.exe 85 PID 3212 wrote to memory of 1736 3212 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7a1f54c81487cd916e9e5ec7c56f7d63_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec2bb46f8,0x7ffec2bb4708,0x7ffec2bb47182⤵PID:1036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,14188080714028755210,12857758084595595540,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:22⤵PID:2116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2264,14188080714028755210,12857758084595595540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2264,14188080714028755210,12857758084595595540,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:82⤵PID:1736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,14188080714028755210,12857758084595595540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,14188080714028755210,12857758084595595540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,14188080714028755210,12857758084595595540,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,14188080714028755210,12857758084595595540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:82⤵PID:980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,14188080714028755210,12857758084595595540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,14188080714028755210,12857758084595595540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:12⤵PID:4116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,14188080714028755210,12857758084595595540,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:12⤵PID:3244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,14188080714028755210,12857758084595595540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:12⤵PID:2552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,14188080714028755210,12857758084595595540,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:12⤵PID:896
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1756
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5537815e7cc5c694912ac0308147852e4
SHA12ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA51263969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
-
Filesize
152B
MD58b167567021ccb1a9fdf073fa9112ef0
SHA13baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA25626764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
-
Filesize
6KB
MD5eeb707de4caf3d8cb50395e6685c25b3
SHA1a158d7e0d83201e2eac188f8a2a3164171c74b42
SHA25638c93b90bfde79931578ae8d604766bf0ba5e20b0c20aea12b5d9e95b671df46
SHA51232c44ba812fd6b27543d189bd871e1aefa6be1432a9cb2ca0a9f49585a573da6b9733858574d3e2cf6693111d70821fc00c150f8f18979c53f2f1a6efacf8fda
-
Filesize
5KB
MD59820bab7a204e0874af1ce491b8e5203
SHA10d12015d7ef5c218d82d7a346fd0ace0fa280162
SHA256fc1648fe0d60ee79b7d485d7b7d7466255c7640da72418dbc9463f8491b418c7
SHA5120eb4adab6027cb1eeb6a83b181f66f70985d903a92f6e27eacf52691f25c6ef728fc8c0f18c936a0e01cacd69e0f3ccff95037a8570874118a78204c4dd6e394
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bd30258f-af88-4b2f-acc2-c2140e3e3e7e.tmp
Filesize6KB
MD5fa5948186604b1b9fb5dc7ee7d9810c9
SHA118e9e1661b90e7bc7cdab1572e281e21b6ba8ebe
SHA2560a1a75f59e31b7f180c433a2672830e224116abfe7f02f3ccef76b7403a33baf
SHA5120a3b29cabc5dd6061ed1b236d5ec1b95f8161f2f616047a91a6cd50dc8c4756b36e80420102b253ddcafa1746fa74291ada90613df5bb0a51b1eab89726bdd2d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5e2a0380bd21d7726507474d217de707f
SHA1d2178a5801d59e11eb2dcddf3136094693bf380c
SHA25623f482d750c38330491c26fdfc582dcc5a1691f7b5c92e90c712d9249f672d18
SHA51255aee780447c22a2ae6cf79ab87f8af4543a9ec1cc6ef30dccec7b8d535f78aafa19657510a85dc8dc3881d8c06989c95a92724f3dd347df35a38f17d0df358f