Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
82b1bd2ea7548f7443a2c050612c7055_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
82b1bd2ea7548f7443a2c050612c7055_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
82b1bd2ea7548f7443a2c050612c7055_JaffaCakes118.html
-
Size
34KB
-
MD5
82b1bd2ea7548f7443a2c050612c7055
-
SHA1
db3dbcd4d0576b11892316c41746254fcfa7765d
-
SHA256
2e5798440bc0fcd7fca36b922f750f2cd3b5c0b1dd27693915a87d77e0c8c298
-
SHA512
2b37432955b46873134e726214ca9e7c35ca4b81bba7b9cd5a363986a74e9a320b84fe96c87bed8c915ff248ed282a953d1f920fad09e2447b52d5da078a8645
-
SSDEEP
768:v7EpFwSXe6eDewe7eIeygjI1rCJC3CNChCICrC/CvCPJExBq0Z24HLx8lF6Fn:vwpFwSuDqtClpjIlEWmyP84yiJ4q0Z2y
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 804 msedge.exe 804 msedge.exe 2360 msedge.exe 2360 msedge.exe 4320 identity_helper.exe 4320 identity_helper.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 5048 2360 msedge.exe 81 PID 2360 wrote to memory of 5048 2360 msedge.exe 81 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 920 2360 msedge.exe 82 PID 2360 wrote to memory of 804 2360 msedge.exe 83 PID 2360 wrote to memory of 804 2360 msedge.exe 83 PID 2360 wrote to memory of 3180 2360 msedge.exe 84 PID 2360 wrote to memory of 3180 2360 msedge.exe 84 PID 2360 wrote to memory of 3180 2360 msedge.exe 84 PID 2360 wrote to memory of 3180 2360 msedge.exe 84 PID 2360 wrote to memory of 3180 2360 msedge.exe 84 PID 2360 wrote to memory of 3180 2360 msedge.exe 84 PID 2360 wrote to memory of 3180 2360 msedge.exe 84 PID 2360 wrote to memory of 3180 2360 msedge.exe 84 PID 2360 wrote to memory of 3180 2360 msedge.exe 84 PID 2360 wrote to memory of 3180 2360 msedge.exe 84 PID 2360 wrote to memory of 3180 2360 msedge.exe 84 PID 2360 wrote to memory of 3180 2360 msedge.exe 84 PID 2360 wrote to memory of 3180 2360 msedge.exe 84 PID 2360 wrote to memory of 3180 2360 msedge.exe 84 PID 2360 wrote to memory of 3180 2360 msedge.exe 84 PID 2360 wrote to memory of 3180 2360 msedge.exe 84 PID 2360 wrote to memory of 3180 2360 msedge.exe 84 PID 2360 wrote to memory of 3180 2360 msedge.exe 84 PID 2360 wrote to memory of 3180 2360 msedge.exe 84 PID 2360 wrote to memory of 3180 2360 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\82b1bd2ea7548f7443a2c050612c7055_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc840f46f8,0x7ffc840f4708,0x7ffc840f47182⤵PID:5048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,635199601534350929,12973695407863493225,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,635199601534350929,12973695407863493225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,635199601534350929,12973695407863493225,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:82⤵PID:3180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,635199601534350929,12973695407863493225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:4868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,635199601534350929,12973695407863493225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,635199601534350929,12973695407863493225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6132 /prefetch:82⤵PID:2848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,635199601534350929,12973695407863493225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6132 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,635199601534350929,12973695407863493225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:12⤵PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,635199601534350929,12973695407863493225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:12⤵PID:4472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,635199601534350929,12973695407863493225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:12⤵PID:3220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,635199601534350929,12973695407863493225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:12⤵PID:1632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,635199601534350929,12973695407863493225,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2424
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1532
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52daa93382bba07cbc40af372d30ec576
SHA1c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA2561826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA51265635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
-
Filesize
152B
MD5ecdc2754d7d2ae862272153aa9b9ca6e
SHA1c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4bea1fbf-eaa9-4423-b61d-3b72d94db480.tmp
Filesize5KB
MD50a36239eef3342495801cc9681a5a448
SHA102bec425d9572f0d2322f7d4054fbe0209c1560b
SHA2568a8a54aab35e86921c58c31224a213bff144b5103891e75ce06b20115864b354
SHA512dc047d029a099d83a3c45f80a62af2ca4861ed1c3be815aa0cd2f3731745c9ba17245d9b4716189cc9754cd2e99ca7ecba65a8d9f9f7434a06149fbd9aeef211
-
Filesize
308B
MD57c873c5fbe6ae79367b5d679df4bbd52
SHA1ba100631a00b41ed200d8a9b287861d35290a05c
SHA2566ad16ab2ed9244dc1f152f3de7f421ee08ec7603a630912e791949d3a288ad4c
SHA512b44aca30ceb12eee06266a9901b6aa8cd27f12743e8940236ca368d8f097a24a537b02c8dfb39fdd713008f7fd5ad9d3e5d15c6b28bee4d26501989d2a83d2d2
-
Filesize
6KB
MD599cb99f82999523c2d7894acb066b531
SHA105c4bd99b1fda520b4a532fb752493827c7c0a71
SHA256442983df9e42a328a784c3a215ecc674b5912e83c99d0f26347da9fdee68f726
SHA5122b5a1ce5fb3fa14353eee887d393f93fb0e04b26c529588b4e413b1d84578d5b2e3dd8dee20a31f4110977ce8bf4fe5e2682e18a04aa5bfc0442ec5bca7b19f9
-
Filesize
6KB
MD50f8a3ea4f59a5ead11ccf9c95ec0ed0b
SHA1fe3b83fa225ccdc250102464a330f9aec87b7ffc
SHA256ff3f90c629f07d240056fd75002b4a7fa33a659cda484066abbd97f58b80ccea
SHA512198c518df9ab4f3a90d891697ee240a0bd07e5e34a4ebaecd3fdb7b491e14d8476183acf4d1089d8abafd834cdd0e36948657db088810e959e357fbb875f4f71
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD59fb6a05f1238cfc8e301de4e4e724f43
SHA195d866d0a3af3c2d6008841811c3e8b45b8cf503
SHA256fb66c774c7f3fe22144a551255e91379d0ca250601e30837199305064475a8e4
SHA512c653100a7cfe19991e5fff2e8ced1c55c49dd84a58834602c81402dab0b11bcd4bb8c90aa3fb2fd889742e998c07713ff82aae6bd9f17d7c40048c1f6e8bbf54