Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2024 04:14
Static task
static1
Behavioral task
behavioral1
Sample
85f1ef661719a8b666b65c9e28f88208_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
85f1ef661719a8b666b65c9e28f88208_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
85f1ef661719a8b666b65c9e28f88208_JaffaCakes118.html
-
Size
868KB
-
MD5
85f1ef661719a8b666b65c9e28f88208
-
SHA1
3351695e197d93ea4a1218e0aa08ba7326100bb0
-
SHA256
fdcb9ba3e182e9ae35acdb69ea6f67c8364c4af787aed61fcf1b5afca034448a
-
SHA512
f50d04b8fee71553200248f6efba1caeeb71931eeb7c60fae0057f88bf9a1d8abe66fd351f9541a1d7e0d8e306501d564b29cfa6f4d8daf7227a5389c836539f
-
SSDEEP
12288:dm5d+X3zjVN5d+X3zjVT5d+X3zjVn5d+X3zjV05d+X3zjVP:dE+Tjb+TjF+Tjd+Tjo+TjZ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3212 msedge.exe 3212 msedge.exe 5080 msedge.exe 5080 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5080 msedge.exe 5080 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5080 wrote to memory of 1812 5080 msedge.exe 83 PID 5080 wrote to memory of 1812 5080 msedge.exe 83 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 692 5080 msedge.exe 84 PID 5080 wrote to memory of 3212 5080 msedge.exe 85 PID 5080 wrote to memory of 3212 5080 msedge.exe 85 PID 5080 wrote to memory of 3628 5080 msedge.exe 86 PID 5080 wrote to memory of 3628 5080 msedge.exe 86 PID 5080 wrote to memory of 3628 5080 msedge.exe 86 PID 5080 wrote to memory of 3628 5080 msedge.exe 86 PID 5080 wrote to memory of 3628 5080 msedge.exe 86 PID 5080 wrote to memory of 3628 5080 msedge.exe 86 PID 5080 wrote to memory of 3628 5080 msedge.exe 86 PID 5080 wrote to memory of 3628 5080 msedge.exe 86 PID 5080 wrote to memory of 3628 5080 msedge.exe 86 PID 5080 wrote to memory of 3628 5080 msedge.exe 86 PID 5080 wrote to memory of 3628 5080 msedge.exe 86 PID 5080 wrote to memory of 3628 5080 msedge.exe 86 PID 5080 wrote to memory of 3628 5080 msedge.exe 86 PID 5080 wrote to memory of 3628 5080 msedge.exe 86 PID 5080 wrote to memory of 3628 5080 msedge.exe 86 PID 5080 wrote to memory of 3628 5080 msedge.exe 86 PID 5080 wrote to memory of 3628 5080 msedge.exe 86 PID 5080 wrote to memory of 3628 5080 msedge.exe 86 PID 5080 wrote to memory of 3628 5080 msedge.exe 86 PID 5080 wrote to memory of 3628 5080 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\85f1ef661719a8b666b65c9e28f88208_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff091646f8,0x7fff09164708,0x7fff091647182⤵PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12411592523166547144,6340111619103549065,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,12411592523166547144,6340111619103549065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,12411592523166547144,6340111619103549065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:82⤵PID:3628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12411592523166547144,6340111619103549065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12411592523166547144,6340111619103549065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵PID:2168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12411592523166547144,6340111619103549065,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2124
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3180
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
Filesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
Filesize
5KB
MD58a331138a86305566d2689dff233f385
SHA1fb7ab9226134594afeaaad6c6808c8e8aad7416d
SHA256200d5d136e397dffbc09c8a282b2022337e4465e14734a95568fad7f78ec0cc0
SHA5122122751e8a22eec1eea4a44f3639e528bc9f5454c5e729f736ea0e0dafd72fff9065e50a7704227517dacc9ed78ebd2e9e378f2b9ea3d21199ae8eebd6cb3eba
-
Filesize
6KB
MD5e3ef137893849128381c4aa7db5fd1ac
SHA1859bd6c083c9681d9d43c7cc9cc509965ceb5342
SHA256fa7f3645efeac7f5f023bc2f4a0d0aa572fb03fe4eca951a084c5ed21bdc438c
SHA5127812a9aaca03405e0543bd607a123853a8b6c1e36769087f6e3662edc60c4bb4a998a3059fb148357c4238083c557212310a0e6679e11ca17f86b4506fa28c77
-
Filesize
6KB
MD59c72244af69c1bc5ebb13226c270c56e
SHA149e2317929999227cb0dcb5eda01688278728b29
SHA256d37195795d13547ab3199c2844e0b9cb88775376930a5d3922bda595e99509b8
SHA512cd7c3454d4ccba7209701c108c6c72841894f53b4243c10c57adfd94ef5584b35fafb4c339050922a7d139f7901eae55baf67fe7fda450003d29afb2f84fe656
-
Filesize
11KB
MD557ee792e1df24389f1b6400890fd5c99
SHA1ccd1e7d32c487ed89e453a34894b94fc88dfd2dd
SHA256a5ea670e016c0e7e16e90280a098eda8e35acd08558b71c435b57ab772343e8c
SHA512f5a2197cffb64f3f1c7d23577b689735fc643b09c5f8bf512606aaa98008ef110b14e0c0e003235c4c207ead1959f4012b22288f497bfd33333d2712d97998d3