Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 08:54
Static task
static1
Behavioral task
behavioral1
Sample
802bc8e4eba52713fb5906c2d90fc024_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
802bc8e4eba52713fb5906c2d90fc024_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
802bc8e4eba52713fb5906c2d90fc024_JaffaCakes118.html
-
Size
59KB
-
MD5
802bc8e4eba52713fb5906c2d90fc024
-
SHA1
b12657d759362bb265f8402dfe2fba83f89cf8cb
-
SHA256
427f8d05cdad1c9f7bbb03929ce64d1a701f424ef9432e53b4c1f2db239feed5
-
SHA512
1a8c7ecb882675c01e4940012fa15a7afc83982f8a491f16f3894e7934be14e87f13cbaa40ad643c837ef3c578031231995aa06727c9e9f42dee8cd9a1868bf8
-
SSDEEP
1536:RRZxAsIib8Kt+Wy9a3umloID/s2cCdnQTvc:RRZxAsIibvt+Wy9a+mloID/slCdnQjc
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1792 msedge.exe 1792 msedge.exe 3500 msedge.exe 3500 msedge.exe 2444 identity_helper.exe 2444 identity_helper.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3500 wrote to memory of 2184 3500 msedge.exe 83 PID 3500 wrote to memory of 2184 3500 msedge.exe 83 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 4788 3500 msedge.exe 84 PID 3500 wrote to memory of 1792 3500 msedge.exe 85 PID 3500 wrote to memory of 1792 3500 msedge.exe 85 PID 3500 wrote to memory of 1892 3500 msedge.exe 86 PID 3500 wrote to memory of 1892 3500 msedge.exe 86 PID 3500 wrote to memory of 1892 3500 msedge.exe 86 PID 3500 wrote to memory of 1892 3500 msedge.exe 86 PID 3500 wrote to memory of 1892 3500 msedge.exe 86 PID 3500 wrote to memory of 1892 3500 msedge.exe 86 PID 3500 wrote to memory of 1892 3500 msedge.exe 86 PID 3500 wrote to memory of 1892 3500 msedge.exe 86 PID 3500 wrote to memory of 1892 3500 msedge.exe 86 PID 3500 wrote to memory of 1892 3500 msedge.exe 86 PID 3500 wrote to memory of 1892 3500 msedge.exe 86 PID 3500 wrote to memory of 1892 3500 msedge.exe 86 PID 3500 wrote to memory of 1892 3500 msedge.exe 86 PID 3500 wrote to memory of 1892 3500 msedge.exe 86 PID 3500 wrote to memory of 1892 3500 msedge.exe 86 PID 3500 wrote to memory of 1892 3500 msedge.exe 86 PID 3500 wrote to memory of 1892 3500 msedge.exe 86 PID 3500 wrote to memory of 1892 3500 msedge.exe 86 PID 3500 wrote to memory of 1892 3500 msedge.exe 86 PID 3500 wrote to memory of 1892 3500 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\802bc8e4eba52713fb5906c2d90fc024_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb236b46f8,0x7ffb236b4708,0x7ffb236b47182⤵PID:2184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,14323494674504781436,7250852113513355059,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2324 /prefetch:22⤵PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,14323494674504781436,7250852113513355059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,14323494674504781436,7250852113513355059,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2396 /prefetch:82⤵PID:1892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,14323494674504781436,7250852113513355059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:12⤵PID:1108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,14323494674504781436,7250852113513355059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,14323494674504781436,7250852113513355059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:82⤵PID:2760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,14323494674504781436,7250852113513355059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,14323494674504781436,7250852113513355059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:12⤵PID:5048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,14323494674504781436,7250852113513355059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:12⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,14323494674504781436,7250852113513355059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:12⤵PID:3936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,14323494674504781436,7250852113513355059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:12⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,14323494674504781436,7250852113513355059,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4864 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4392
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:432
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1828
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
Filesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
Filesize
627B
MD5da719dfbd9d27b338f004c008d05dcee
SHA1284e6a610305a14552bb1ed46543bcf543ff1fc0
SHA256d2a891b08b4dabb057ca243881fec7c4b48da957002c92ff1404bf5521226a3c
SHA5128c5db70bac8b011e370b2ccf957006c11b279f442f620a53f5681f5119dcd4ba8046fcb79ada9251ef76423ed70107e86f6f39b784c65d4cc0a32d7225a3755b
-
Filesize
5KB
MD5e98627e498cc05fab1d9dc093d8ef9b9
SHA17106e3ef2bf8212540c17fff109c414e7d296126
SHA2569dcd01f7d23a9b935facc68921900979e024ea7af2d5c214c7f58283d35ff780
SHA51273841332d2ee1c8d86bb985fbd0d75a35ac7437ef3655c997fb636b9dc29dfb767141ee08ca321e81262b464a73c816aecbb67a1a9f3585993811a98259534aa
-
Filesize
6KB
MD5fb13a0e395546a11aa081f114e1de22a
SHA1cc1fe95190c18f7156e6c5047f1b615a414b1dde
SHA2569316b9be840a5a3fcbd4519473cbd24f1b906bd5e2c62616f4f74d1019056b41
SHA5128ba9495f300363c49353225fe0db9306c46879e8c626802030414af496d64499471c7b77079e5f948a4478634ac59b79587bc605cd1795bdbec97f5e80bb4966
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD595fa9e3fa1ff1521b1a5c83015c84618
SHA1303eedc522aba1636055cf5f63df82e48c3e77e0
SHA256e7b12070ac201bec65fd4575e0a0c528094c02c909443ce9d59c6c8e22083599
SHA512d9ddbdd83df6588f59af1500728e511a57c08400829367cfd315c7318e36857c96afe8db38d4bfbd3315767df0d517a5c56c4115774b4d935aae5fa93a5c893d