Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29-05-2024 11:54
Static task
static1
Behavioral task
behavioral1
Sample
80a5678a59cdeba3735ce23f8ba198ef_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
80a5678a59cdeba3735ce23f8ba198ef_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
80a5678a59cdeba3735ce23f8ba198ef_JaffaCakes118.html
-
Size
84KB
-
MD5
80a5678a59cdeba3735ce23f8ba198ef
-
SHA1
466761b020a48c3665701ac9ed2fef3159aeb21b
-
SHA256
11b12aa63fb21a3d6473e1715e84e8b3372120089f5cd821461eb66e1524edaa
-
SHA512
e9c259eb1ba96722d1dcd79157b28d28ddb1018c7dfdd43d43fbf022de8936c1105155093f12d1664746048991ccbce2ee635329c70934c87fd1f9533487afe6
-
SSDEEP
1536:OpvQjIk1TLq5Q8ExENE1FIzEV8EBj6AjeEPEPPVgqUEih4E8EME9J5My2mT/EOP/:evQHpBxUWE1csdVFE1J
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4856 msedge.exe 4856 msedge.exe 1188 msedge.exe 1188 msedge.exe 2708 identity_helper.exe 2708 identity_helper.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe 2664 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe 1188 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1188 wrote to memory of 4608 1188 msedge.exe 82 PID 1188 wrote to memory of 4608 1188 msedge.exe 82 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 1232 1188 msedge.exe 83 PID 1188 wrote to memory of 4856 1188 msedge.exe 84 PID 1188 wrote to memory of 4856 1188 msedge.exe 84 PID 1188 wrote to memory of 1600 1188 msedge.exe 85 PID 1188 wrote to memory of 1600 1188 msedge.exe 85 PID 1188 wrote to memory of 1600 1188 msedge.exe 85 PID 1188 wrote to memory of 1600 1188 msedge.exe 85 PID 1188 wrote to memory of 1600 1188 msedge.exe 85 PID 1188 wrote to memory of 1600 1188 msedge.exe 85 PID 1188 wrote to memory of 1600 1188 msedge.exe 85 PID 1188 wrote to memory of 1600 1188 msedge.exe 85 PID 1188 wrote to memory of 1600 1188 msedge.exe 85 PID 1188 wrote to memory of 1600 1188 msedge.exe 85 PID 1188 wrote to memory of 1600 1188 msedge.exe 85 PID 1188 wrote to memory of 1600 1188 msedge.exe 85 PID 1188 wrote to memory of 1600 1188 msedge.exe 85 PID 1188 wrote to memory of 1600 1188 msedge.exe 85 PID 1188 wrote to memory of 1600 1188 msedge.exe 85 PID 1188 wrote to memory of 1600 1188 msedge.exe 85 PID 1188 wrote to memory of 1600 1188 msedge.exe 85 PID 1188 wrote to memory of 1600 1188 msedge.exe 85 PID 1188 wrote to memory of 1600 1188 msedge.exe 85 PID 1188 wrote to memory of 1600 1188 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\80a5678a59cdeba3735ce23f8ba198ef_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff2ca46f8,0x7ffff2ca4708,0x7ffff2ca47182⤵PID:4608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,16106766631896017417,2402804613781886201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:22⤵PID:1232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,16106766631896017417,2402804613781886201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,16106766631896017417,2402804613781886201,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:82⤵PID:1600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16106766631896017417,2402804613781886201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:2756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16106766631896017417,2402804613781886201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:3828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16106766631896017417,2402804613781886201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:12⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16106766631896017417,2402804613781886201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:12⤵PID:1424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,16106766631896017417,2402804613781886201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:82⤵PID:992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,16106766631896017417,2402804613781886201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16106766631896017417,2402804613781886201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:12⤵PID:860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16106766631896017417,2402804613781886201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:12⤵PID:2172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16106766631896017417,2402804613781886201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:12⤵PID:4720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16106766631896017417,2402804613781886201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:12⤵PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,16106766631896017417,2402804613781886201,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3044 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2664
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1604
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3132
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
Filesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize360B
MD576f9100743262e4e2e1c9abc07c1ca30
SHA1bb5c043ac6ebc9bba59f18d6d8d167cc6fdd4f8c
SHA256bf65280907fbf8c97e79c15145b60e950f59697b73047998ef2b9764abec3950
SHA5127f1f77308bc83672aaba6e3f06eade056b19fd64a450b0c63817ecfdd6ef68baeec04c7262d9587a77b03f6e33d635cf0ba5ce7b2b110bc83cf3e399145bf565
-
Filesize
1KB
MD5e26f988b538a772713c3cb7d0a8ff879
SHA18cc8319594b22a49ec7217aefe7eee976d8b95a3
SHA256599c2d66d860dd6f9606361d6da4729c0aa4df13ff7e7fad0133e95db029e75b
SHA5124df3cd658c837be842002b468b69329cfea786f82f33aadec3dd3bfbd394cf0968dd1ce39896c62f68f95fcee2e47f4592a6151e7155dd77dc71268887248bd5
-
Filesize
5KB
MD59eeb6e0f26596ad21269a9cac7aaf1d5
SHA12c027cdcbdad364ccd2da702cece57ffc24c2448
SHA2567242352cfe2bb64defb4a69750097b555836391e954432d8be8bf373d1f90e50
SHA5127e6fa8cac72a67147e375957b9c31f6f00ae6aba5313f2f0bcd6f79d25e0b9a1207bae01dfeb35b439b2c58625d449bf81ef71e07d3e3c4337e79b1e1ef4ae43
-
Filesize
6KB
MD5dc8e18d3ed9a0157f59c3cee0401a892
SHA1ab32a8b18f2b39e79759b6e72e2d213478f3a800
SHA25615efdf5e5929eb70539115832538c3ec23e6794af20839370f1825118ce915a8
SHA512a393edff3694767b09306e851101395b2d9a1e0be9fcb459c33ab921218ee82e9eab22093580f0049db0939b8b6df3cb875a603c757b53f5d255e7c01c123a18
-
Filesize
6KB
MD5d0d736d0ea04cbaf68eb55f3d5036b16
SHA13d1fadab5cd8e77bb2daac385ea6825b9be3a659
SHA256a9ddf5a407383df793860a99e421b74e4c3861cc4043f40b0d52ea8575190c15
SHA5126021c7b749ea9649a6776774f8ef94145d364e709c6554a7027b300b98fd1216e14a6508a75007b68bd0aad5be54493a4b42ba213d0dc45bf1117f07dad1cd3b
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD501765c656551f24e9df3ab621e38aa6c
SHA1f9f8f144733740ac31fef0076f472dccf0f5e78d
SHA2561cd6febb64e7ecad0dbede2d24ed452d9c4f7150df8f15a173f6ae0fe2655404
SHA51296b343d898d39d1bfe2cd43d17d1daf6fd030688577e69d236c26518d3eb69eefd97f69430cab7d33e5f6a8fb4697c7b15a500efce9df3cc0f77d42cae70463d