Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 14:14
Static task
static1
Behavioral task
behavioral1
Sample
846e9a32339a934684570ff2cb7f58d6_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
846e9a32339a934684570ff2cb7f58d6_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
846e9a32339a934684570ff2cb7f58d6_JaffaCakes118.html
-
Size
76KB
-
MD5
846e9a32339a934684570ff2cb7f58d6
-
SHA1
3ceeecabb336fe640bad7b79afdc5de2b9d5bc74
-
SHA256
3375769a9bcf444ff676d3c9bf0c1f989751509cc1c7368c99a4671c3fe1510d
-
SHA512
b747b7aad2cde8ce7312ad11cf703b6d431f375eb7c0536c8911d060379def2ca9f11e4f0c48e935e62c97dd957ee656c987fc008717780938ca5ed5f3a5405f
-
SSDEEP
1536:IDgN+ycJI1hMSEjxSpI9trEzTSXLqa7I9tu1KuzMsRCOIOII:IDg31RI9pEaXLqa7I90T
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3752 msedge.exe 3752 msedge.exe 5012 msedge.exe 5012 msedge.exe 1332 identity_helper.exe 1332 identity_helper.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5012 wrote to memory of 5028 5012 msedge.exe 81 PID 5012 wrote to memory of 5028 5012 msedge.exe 81 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 1944 5012 msedge.exe 82 PID 5012 wrote to memory of 3752 5012 msedge.exe 83 PID 5012 wrote to memory of 3752 5012 msedge.exe 83 PID 5012 wrote to memory of 5056 5012 msedge.exe 84 PID 5012 wrote to memory of 5056 5012 msedge.exe 84 PID 5012 wrote to memory of 5056 5012 msedge.exe 84 PID 5012 wrote to memory of 5056 5012 msedge.exe 84 PID 5012 wrote to memory of 5056 5012 msedge.exe 84 PID 5012 wrote to memory of 5056 5012 msedge.exe 84 PID 5012 wrote to memory of 5056 5012 msedge.exe 84 PID 5012 wrote to memory of 5056 5012 msedge.exe 84 PID 5012 wrote to memory of 5056 5012 msedge.exe 84 PID 5012 wrote to memory of 5056 5012 msedge.exe 84 PID 5012 wrote to memory of 5056 5012 msedge.exe 84 PID 5012 wrote to memory of 5056 5012 msedge.exe 84 PID 5012 wrote to memory of 5056 5012 msedge.exe 84 PID 5012 wrote to memory of 5056 5012 msedge.exe 84 PID 5012 wrote to memory of 5056 5012 msedge.exe 84 PID 5012 wrote to memory of 5056 5012 msedge.exe 84 PID 5012 wrote to memory of 5056 5012 msedge.exe 84 PID 5012 wrote to memory of 5056 5012 msedge.exe 84 PID 5012 wrote to memory of 5056 5012 msedge.exe 84 PID 5012 wrote to memory of 5056 5012 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\846e9a32339a934684570ff2cb7f58d6_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9d6946f8,0x7ffb9d694708,0x7ffb9d6947182⤵PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,6297625852936785790,8834479737213147414,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:22⤵PID:1944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,6297625852936785790,8834479737213147414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,6297625852936785790,8834479737213147414,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6297625852936785790,8834479737213147414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6297625852936785790,8834479737213147414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:4684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6297625852936785790,8834479737213147414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:12⤵PID:3620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6297625852936785790,8834479737213147414,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:12⤵PID:3460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,6297625852936785790,8834479737213147414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:82⤵PID:3552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,6297625852936785790,8834479737213147414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6297625852936785790,8834479737213147414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:12⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6297625852936785790,8834479737213147414,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:12⤵PID:1788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,6297625852936785790,8834479737213147414,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4804 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1008
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4236
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2164
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA2565009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
-
Filesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
Filesize
484B
MD5a13aba8a361d8576d62bce2dd0ff9b69
SHA11ff599039a4c6bb5a30f5aa25ada1dd36949d775
SHA25618b32c15fc9c5eac1f5537e62926a8b60965b064399391606c3600bad8ed2993
SHA5121114512fe96f0c672c8c406a1c28198eb22f3888ec78d56d4e10707732a301a728e0ffef3c736e6c2dbafeaf24ecb66ed95c29408af3010ad8699085af5b244e
-
Filesize
484B
MD546a4892ec2495434ef7785d6dcdb37b3
SHA1c08b87c0d5bb0472488db62e597cf6ed9b3000a3
SHA25636680c904f4b286311cabb41e7a09467b51cf4f19a214c212c7b230eca13cac1
SHA512f9147c742878f830b89ffc997cc8c5f6b7a0ae3bf328848e5a28abbd14541ac0ec5226180433491c1b1dbd427bf703e65f5633b488396b0389e0ecf500a07174
-
Filesize
6KB
MD5e756dfd60d34fb47a0581e5873eb8aa8
SHA128c0306049d7a0eb35df879cd1e79c7fe63a24f1
SHA2562d3eb4007d3795c2be52041bba91ba40105266e19f9f40514060d60de84974cc
SHA5127a38fd4b84b336f6cff750c763e51402e00b0860a3b7d7a6d080ed2f848a3b66593485406cef4cfc5f32224e35f4e9b53d1b2d864fdd9dd379d3b8e2bbe551c8
-
Filesize
6KB
MD5ae832d7512174e235e37910f363252fc
SHA109e3b263639f587ec538d02c86308a0e65197762
SHA25635c47e70992eb24d3065b149447b1210521d9ced255726c2067de1e7b95adbc1
SHA512ddb4944413b0d002f8ce8f665c57d7d38e73e8302969748e74932315a9e7c0245b625235d09e3c42018ea183c2db592ac5945867bb9380fd0bc1714d47fb308b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b44810d6-3229-461c-858a-de882fee330b.tmp
Filesize5KB
MD5779e8c5f61d2ceca5490478bcca7b5df
SHA164e39073c89f432e4979ae7c2bde94344838ec79
SHA25630fcc803da8d490e377de2caa74025c04ebd35800452d6e8d8abed1694bcb7b0
SHA5122a9a5034c711dfb0f604bbd2983ab7eff64359694c9b8d1b85e282861ba7662c6d69110b3a97901c9cb6e990377a0d7359408617c3b6afa0053c36f949314f0d
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD53ddeca611b888d56d6ec7763c91a1003
SHA122430293f15b69658a5b2289e4ba10784c77da78
SHA256676b25c819cb957ffed186a91734af75486b4cd4034211a9967eb300c8c5ad87
SHA512d6c4a21658809338fb3370c79b1c8a197042ef1aa247e13cd581608892c87b18e996fe231796efb34b58ee5c34b218fe6f1c3c078cbe220263318389496839e4