Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
82b1d245fbece9cfdc2f4b2fc0ea6d57_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
82b1d245fbece9cfdc2f4b2fc0ea6d57_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
82b1d245fbece9cfdc2f4b2fc0ea6d57_JaffaCakes118.html
-
Size
139KB
-
MD5
82b1d245fbece9cfdc2f4b2fc0ea6d57
-
SHA1
0867a22a19915e9b3fd7a738179a4d8ea479ed04
-
SHA256
9d6771f214219cba400e454b940779ddfac0f0ab9bba0d8cd12ed832271af091
-
SHA512
80260a3993e172d38394b6ebd6ca03cae04bc0822101d23049b890abc4ed5940cd3f2cbe9174543f135c753e0fabe110340787a663a8ab543eb6b3f31b3a1104
-
SSDEEP
1536:SArNsoQvj6Xlc9yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:SAroG+9yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2628 msedge.exe 2628 msedge.exe 2364 msedge.exe 2364 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2364 msedge.exe 2364 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 1472 2364 msedge.exe 82 PID 2364 wrote to memory of 1472 2364 msedge.exe 82 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 2628 2364 msedge.exe 84 PID 2364 wrote to memory of 2628 2364 msedge.exe 84 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\82b1d245fbece9cfdc2f4b2fc0ea6d57_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0b3546f8,0x7ffc0b354708,0x7ffc0b3547182⤵PID:1472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5900133362692575642,14857619948409947867,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:1800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,5900133362692575642,14857619948409947867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,5900133362692575642,14857619948409947867,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵PID:2864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5900133362692575642,14857619948409947867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:2776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5900133362692575642,14857619948409947867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5900133362692575642,14857619948409947867,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4980 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3144
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1208
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
Filesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
Filesize
6KB
MD53ed639820f085b9b0077183812ffc02f
SHA11b69a82dad51653ff1ec38981ac54826e934f45b
SHA256aeda6025435444f9d15f684181a7ac2ef5f2364ffa7d01ff00add64c778b0a0e
SHA5123ecb8e42c85550ae6834ecc375486e6e03c7f22f9618d63a7c98f4665156799fce18cc122d7020c23f733160486bd3aaeb37512bb1f60ed27c5b93c0b5347e88
-
Filesize
5KB
MD51c83010d816543e58c09e8b5b2d6f393
SHA1e9340fca8613e4adf70fc111243d0b29628030ff
SHA2562c2e9795943d40f59efad37b644926a2015d660800609086a0355c6ef38cb1f1
SHA512aac815223647e6363239bdeaa60fbc534ed1a96ac352ed36d59ca0bee82a897879c3e877dec4565a0821e263c35b7cdb80b6151c01bfab2db121fbbed0532410
-
Filesize
11KB
MD592897c79f11b7bdae2f57b52b3ae1cce
SHA10b001a6e7e4de69b3d0c6e78a897f8a90fe4b9bb
SHA256f4b7e5b305c31d184feb702622b2ed3f49450da1fe5a106622a68a409580f6e2
SHA5121671e298aa77faf95319dbcbfcb2a7df7182e90931f910eff81c70c531cd6c1352b345ebe9fe1102de1dbac236ca567f19271b439cd6c2800de64763591535f2