Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 14:07
Static task
static1
Behavioral task
behavioral1
Sample
846a5f44bb368b9e25871fff47d76c52_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
846a5f44bb368b9e25871fff47d76c52_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
846a5f44bb368b9e25871fff47d76c52_JaffaCakes118.html
-
Size
34KB
-
MD5
846a5f44bb368b9e25871fff47d76c52
-
SHA1
4d6cd307fb33d3fccc15652b748250a9e7d73d82
-
SHA256
b5dc4708bf3f208b73ec4771fe84787572404692ff3b368f2de9c6246e363d2b
-
SHA512
7212ddbe667d27b4ddb3ac79aefde8895a7350a9898289bad2161dd08bfd28d7281d343e98d6ef80526b4f45242f3c5de75421c1481844c223c16d113844f40c
-
SSDEEP
192:uWTnb5nSd8PnQjxn5Q/snQie3NnCnQOkEntMmnQTbnFnQ6XCrAWpW+knaZUcFqNo:mQ/Nq3sQpY4tHp/dz6LNFOP
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1348 msedge.exe 1348 msedge.exe 4080 msedge.exe 4080 msedge.exe 1316 identity_helper.exe 1316 identity_helper.exe 1700 msedge.exe 1700 msedge.exe 1700 msedge.exe 1700 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4080 wrote to memory of 3060 4080 msedge.exe 84 PID 4080 wrote to memory of 3060 4080 msedge.exe 84 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 3020 4080 msedge.exe 85 PID 4080 wrote to memory of 1348 4080 msedge.exe 86 PID 4080 wrote to memory of 1348 4080 msedge.exe 86 PID 4080 wrote to memory of 4320 4080 msedge.exe 87 PID 4080 wrote to memory of 4320 4080 msedge.exe 87 PID 4080 wrote to memory of 4320 4080 msedge.exe 87 PID 4080 wrote to memory of 4320 4080 msedge.exe 87 PID 4080 wrote to memory of 4320 4080 msedge.exe 87 PID 4080 wrote to memory of 4320 4080 msedge.exe 87 PID 4080 wrote to memory of 4320 4080 msedge.exe 87 PID 4080 wrote to memory of 4320 4080 msedge.exe 87 PID 4080 wrote to memory of 4320 4080 msedge.exe 87 PID 4080 wrote to memory of 4320 4080 msedge.exe 87 PID 4080 wrote to memory of 4320 4080 msedge.exe 87 PID 4080 wrote to memory of 4320 4080 msedge.exe 87 PID 4080 wrote to memory of 4320 4080 msedge.exe 87 PID 4080 wrote to memory of 4320 4080 msedge.exe 87 PID 4080 wrote to memory of 4320 4080 msedge.exe 87 PID 4080 wrote to memory of 4320 4080 msedge.exe 87 PID 4080 wrote to memory of 4320 4080 msedge.exe 87 PID 4080 wrote to memory of 4320 4080 msedge.exe 87 PID 4080 wrote to memory of 4320 4080 msedge.exe 87 PID 4080 wrote to memory of 4320 4080 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\846a5f44bb368b9e25871fff47d76c52_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc835446f8,0x7ffc83544708,0x7ffc835447182⤵PID:3060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8692585147615996983,14312817575710453975,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:3020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,8692585147615996983,14312817575710453975,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,8692585147615996983,14312817575710453975,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:82⤵PID:4320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8692585147615996983,14312817575710453975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:1116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8692585147615996983,14312817575710453975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:2876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8692585147615996983,14312817575710453975,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:82⤵PID:3124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8692585147615996983,14312817575710453975,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8692585147615996983,14312817575710453975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:12⤵PID:1796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8692585147615996983,14312817575710453975,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:12⤵PID:4492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8692585147615996983,14312817575710453975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2196 /prefetch:12⤵PID:908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8692585147615996983,14312817575710453975,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:12⤵PID:3292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8692585147615996983,14312817575710453975,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3248 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1700
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2460
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2a14c4e8-d062-4c36-bdfc-10a09b896428.tmp
Filesize6KB
MD5e9e7b87bbfef4658bf30abbce9feb0e7
SHA17a53fd37c44c9b70780b105cef7dd523d0e6a4fc
SHA2561c2f2ee6d958b5360fa8fb00989095575741548dd40b44c00700dbbd48b85924
SHA5127e070fe08411d99ecd019a2c648312fcf8a0f8f830c48e49f792737882fcd8c7038b86185f29e8d8bd75f307c1244bb90cf4d1c836750e6ca12e24e66f44a587
-
Filesize
5KB
MD5a237e251160e7a0866f26bd0f8debd18
SHA1bee303b4cb8a0d05a75d9a0c5077dc81c2d8521f
SHA2564b3f6100d3c40b3b71a9612b50cd928909d1afdd5804b6f02ef3b5301dc22236
SHA51202d896e0e686106d13c1fef08a13bdee1fcd5b392f735151377de396473d4d23ee88a1cba1779e7c1714e6e96c339ab2fe14a9f76835eb6c55a0fa36caad3ae5
-
Filesize
6KB
MD52d38217e2c2dba4d65de580f0c2807f0
SHA1a1998b99f1e63af8b33852ec2681c36fa0458305
SHA2569bee44aeed18a8670e7fafff1317f92d3e04d71dfc308fbf8144465e4ccc9747
SHA5127e69d007f1553d420ede9d276a7c3ff50e03f86e9a87f68acf0673e170e7aeb4761e4f13919843e2aba42b5a8fdbc5ab7a876fff42b29a78bfdf27c1be10c3a4
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5247e4ccbd401377257cf817623e2e27d
SHA15b499be3ff97c8fa33a94532eda0170830113606
SHA2567aab106e5d78a716f8aec589006667f23cd17bc35523daaf53346be565b6210f
SHA5122daf5c6adbabb871a0f887c9da93259ed631334716b6d21c0f5428885b0884642431f280df07c69b8b8f1af61142c23eb91cae48150a9d84d1077af350d65496