Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 15:52
Static task
static1
Behavioral task
behavioral1
Sample
878b4c379f71d09855e8387d3e8a1ae0_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
878b4c379f71d09855e8387d3e8a1ae0_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
878b4c379f71d09855e8387d3e8a1ae0_JaffaCakes118.html
-
Size
14KB
-
MD5
878b4c379f71d09855e8387d3e8a1ae0
-
SHA1
46b7d070448b87c7fa594555d1b0d6c5bbe28afa
-
SHA256
7e1a384e14bc5ed3380775494a5abaadcef0aa9b9f9b3a870de77f8e5b3224d1
-
SHA512
b0e11d500b1467f910b1e10f29cb1d9c79571bed3627e03d71669f89fda0dcdd460e4db9db9f8433691596f23c1a9f324fe8d78083a0de5a72068870288a3dd0
-
SSDEEP
384:SItPh/qXq2qMqLq8qrqjqrq9qvqeqyqMtp:SuPh/qXq2qMqLq8qrqjqrq9qvqeqyqMH
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4116 msedge.exe 4116 msedge.exe 2552 msedge.exe 2552 msedge.exe 4152 identity_helper.exe 4152 identity_helper.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2552 wrote to memory of 3612 2552 msedge.exe 82 PID 2552 wrote to memory of 3612 2552 msedge.exe 82 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 3540 2552 msedge.exe 83 PID 2552 wrote to memory of 4116 2552 msedge.exe 84 PID 2552 wrote to memory of 4116 2552 msedge.exe 84 PID 2552 wrote to memory of 4180 2552 msedge.exe 85 PID 2552 wrote to memory of 4180 2552 msedge.exe 85 PID 2552 wrote to memory of 4180 2552 msedge.exe 85 PID 2552 wrote to memory of 4180 2552 msedge.exe 85 PID 2552 wrote to memory of 4180 2552 msedge.exe 85 PID 2552 wrote to memory of 4180 2552 msedge.exe 85 PID 2552 wrote to memory of 4180 2552 msedge.exe 85 PID 2552 wrote to memory of 4180 2552 msedge.exe 85 PID 2552 wrote to memory of 4180 2552 msedge.exe 85 PID 2552 wrote to memory of 4180 2552 msedge.exe 85 PID 2552 wrote to memory of 4180 2552 msedge.exe 85 PID 2552 wrote to memory of 4180 2552 msedge.exe 85 PID 2552 wrote to memory of 4180 2552 msedge.exe 85 PID 2552 wrote to memory of 4180 2552 msedge.exe 85 PID 2552 wrote to memory of 4180 2552 msedge.exe 85 PID 2552 wrote to memory of 4180 2552 msedge.exe 85 PID 2552 wrote to memory of 4180 2552 msedge.exe 85 PID 2552 wrote to memory of 4180 2552 msedge.exe 85 PID 2552 wrote to memory of 4180 2552 msedge.exe 85 PID 2552 wrote to memory of 4180 2552 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\878b4c379f71d09855e8387d3e8a1ae0_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9903a46f8,0x7ff9903a4708,0x7ff9903a47182⤵PID:3612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14263189041928704231,9158661215954738689,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:3540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,14263189041928704231,9158661215954738689,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,14263189041928704231,9158661215954738689,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵PID:4180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14263189041928704231,9158661215954738689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:2032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14263189041928704231,9158661215954738689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14263189041928704231,9158661215954738689,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:82⤵PID:1392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14263189041928704231,9158661215954738689,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14263189041928704231,9158661215954738689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:12⤵PID:4024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14263189041928704231,9158661215954738689,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:12⤵PID:2436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14263189041928704231,9158661215954738689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:12⤵PID:4804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14263189041928704231,9158661215954738689,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:12⤵PID:2924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14263189041928704231,9158661215954738689,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5164 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:668
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3436
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5dea9f5f-1572-434f-9855-5d7539c0fc5c.tmp
Filesize6KB
MD5d528f5f3bead1a413d35a30ad4c9a23b
SHA1facaf52e30b5aedaee80ef2cb9031c37d03f70f7
SHA2568536167440aa2389515cb6bf9b79dff12ded4443d2fa63f0588b5aa02a1adac0
SHA512324bc6b4ab6577c3dc9cbf0a3eb52709a22dc7fb14e91a4502dc122be414ae720ac64540182ef4bd8452b4324a48bdd499d9adb303b89c5a1e321ca2d659d3e2
-
Filesize
5KB
MD5e9581ca7113014b9282d1cfa4b1ef8d3
SHA13e03335197127f745cc416943e490f211b1bd25e
SHA256a68d39d48df4b1d62237e3ad0da98cf7d57abc332ad66bec200420748d38bbf8
SHA51236ff9ef55ae8e8096d1d9ae2b580d63634927ebb3298179f9be14d3d18bac4a5c04187ba3cdff5c0e3cbe0ecf723da81ba9bdbe1ae863f36da267168a22a6a82
-
Filesize
6KB
MD5660219606fa8f288847a3ef665964d1f
SHA14367f0a1ca4094f0bbe48bb515e1577133b3ac13
SHA256eeccf660b0a395cae57ae792c892a524bf719688a467ca5b1f41421be589a489
SHA512e4ef534fa50a1c14aa8f2fc0e04b5283b6783a354f726d22337a58fa6c32683bfed70ab27403bd6ae94ebf5a6fb2a288eb5c200b5d751ef3ba2d4fd8fc3fdb1f
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5c947498019e04f8d0806efebe28c611a
SHA11d2f1336158d1e5de303d54c30b2fc9576549a3a
SHA2568d870bf5983badfce88d9c894cb36c434347e57e239508fea1c6818b3af7c10f
SHA5129ec9bd473623fedb952e608a9d4893e85be8f736be635b67f9e31f7570b514fcad9da50eccb1d85289a96b56ba5c476f9d6f0342f7bcb35527032be3bcf6b55e