Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
82b1a946db310ffddbe63e3aad32e0e9_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
82b1a946db310ffddbe63e3aad32e0e9_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
82b1a946db310ffddbe63e3aad32e0e9_JaffaCakes118.html
-
Size
139KB
-
MD5
82b1a946db310ffddbe63e3aad32e0e9
-
SHA1
6ebf7876e69be86c4a411fd9b4c69937759bfe0f
-
SHA256
fae8826645808dd1ba50ecd6b1e16ecfc421fd0072ffc5a251b1ed3b52e4a55e
-
SHA512
1140d8a4b741853108d8d60e47d84b7997bc88288308dbe26505388b33f05a5bdcae8b358cf2cbbcb6e38e43eecfd0383f73e8f7097085d371313f2177ecca67
-
SSDEEP
1536:SQ+BEOEdDKx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:SpEUx7dyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4860 msedge.exe 4860 msedge.exe 1168 msedge.exe 1168 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1168 msedge.exe 1168 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1168 wrote to memory of 2328 1168 msedge.exe 83 PID 1168 wrote to memory of 2328 1168 msedge.exe 83 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 2736 1168 msedge.exe 84 PID 1168 wrote to memory of 4860 1168 msedge.exe 85 PID 1168 wrote to memory of 4860 1168 msedge.exe 85 PID 1168 wrote to memory of 4888 1168 msedge.exe 86 PID 1168 wrote to memory of 4888 1168 msedge.exe 86 PID 1168 wrote to memory of 4888 1168 msedge.exe 86 PID 1168 wrote to memory of 4888 1168 msedge.exe 86 PID 1168 wrote to memory of 4888 1168 msedge.exe 86 PID 1168 wrote to memory of 4888 1168 msedge.exe 86 PID 1168 wrote to memory of 4888 1168 msedge.exe 86 PID 1168 wrote to memory of 4888 1168 msedge.exe 86 PID 1168 wrote to memory of 4888 1168 msedge.exe 86 PID 1168 wrote to memory of 4888 1168 msedge.exe 86 PID 1168 wrote to memory of 4888 1168 msedge.exe 86 PID 1168 wrote to memory of 4888 1168 msedge.exe 86 PID 1168 wrote to memory of 4888 1168 msedge.exe 86 PID 1168 wrote to memory of 4888 1168 msedge.exe 86 PID 1168 wrote to memory of 4888 1168 msedge.exe 86 PID 1168 wrote to memory of 4888 1168 msedge.exe 86 PID 1168 wrote to memory of 4888 1168 msedge.exe 86 PID 1168 wrote to memory of 4888 1168 msedge.exe 86 PID 1168 wrote to memory of 4888 1168 msedge.exe 86 PID 1168 wrote to memory of 4888 1168 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\82b1a946db310ffddbe63e3aad32e0e9_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a47946f8,0x7ff8a4794708,0x7ff8a47947182⤵PID:2328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4419010071658898203,5918751340336753582,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,4419010071658898203,5918751340336753582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,4419010071658898203,5918751340336753582,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4419010071658898203,5918751340336753582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:3216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4419010071658898203,5918751340336753582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4419010071658898203,5918751340336753582,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2276
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:888
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
5KB
MD596fba41a3ac6d6f88b7c71ab24c39c69
SHA17274716fd58959357cd59e1b8a022bdb7118634d
SHA256fa8d005018a855f0d678a604adcd212cb7af76eaeb0fb2d9d764712f8653c46f
SHA512d86b582cd8c989fdd8e6edaf109d2d98bb65e771a2b62e1d6cc2c9c63c8185fcc240ae637a014418783468e14b7088669f9f85d82419fcbf265b8d7539f98b1a
-
Filesize
6KB
MD5874b314ce3f752ac09113c103cb24f15
SHA1994b950b4f6023b4589cf11179239cb778cbeb5c
SHA2569dce7e0c5c028dad3d14decc12b89f1c6cf4805f7dac845b982c2c12395ab0b9
SHA5124052933edad4b3848e5fc51f5a71bc0aec4032150a458fb75b34faad2a6502e8953ada72c3ff5a9f549454035bb2110b1ddd5e6a8360d5c67b158444b6b5d0a6
-
Filesize
11KB
MD5c1edd7b79dc265c1dc0dbc54458bf031
SHA109650eb265d5735553793f081940de76cee1f417
SHA256c8cfb7763d413fb963075fc68810c4aab5e23e93a39ab1b33a1d5a6940c0abe3
SHA512512ee825ab0d75b6e54949686b6a22c892ad92a421640b4b245e9bee37b1b1276dacb7e53e40ed02617130fd3eb0659755312236c5e24657879c4e20e9b64bdf