Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 20:05
Static task
static1
Behavioral task
behavioral1
Sample
8b9e081803cc60e763c04767e22ec665_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8b9e081803cc60e763c04767e22ec665_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8b9e081803cc60e763c04767e22ec665_JaffaCakes118.html
-
Size
19KB
-
MD5
8b9e081803cc60e763c04767e22ec665
-
SHA1
4a1cd4cd6764df40b93d38aff0ee8f01532ac363
-
SHA256
c5c7ce7b09b5557d4153e3a496871a3c7c469bf5843826284de2e66c1b238dfe
-
SHA512
a4f33f76b2f3b6e0654dc2ba9b8ea1ef68d5381bfc507ae7db804c5d2cf2b46c2c8e83597db7069499e8dd6c4aabfd84a7df912974cf8982a4d044a72a72fde2
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAI543zUnjBhZj82qDB8:SIMd0I5nvHtsvZYxDB8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1056 msedge.exe 1056 msedge.exe 2712 msedge.exe 2712 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2712 msedge.exe 2712 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe 2712 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2712 wrote to memory of 3728 2712 msedge.exe 82 PID 2712 wrote to memory of 3728 2712 msedge.exe 82 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 3044 2712 msedge.exe 83 PID 2712 wrote to memory of 1056 2712 msedge.exe 84 PID 2712 wrote to memory of 1056 2712 msedge.exe 84 PID 2712 wrote to memory of 4180 2712 msedge.exe 85 PID 2712 wrote to memory of 4180 2712 msedge.exe 85 PID 2712 wrote to memory of 4180 2712 msedge.exe 85 PID 2712 wrote to memory of 4180 2712 msedge.exe 85 PID 2712 wrote to memory of 4180 2712 msedge.exe 85 PID 2712 wrote to memory of 4180 2712 msedge.exe 85 PID 2712 wrote to memory of 4180 2712 msedge.exe 85 PID 2712 wrote to memory of 4180 2712 msedge.exe 85 PID 2712 wrote to memory of 4180 2712 msedge.exe 85 PID 2712 wrote to memory of 4180 2712 msedge.exe 85 PID 2712 wrote to memory of 4180 2712 msedge.exe 85 PID 2712 wrote to memory of 4180 2712 msedge.exe 85 PID 2712 wrote to memory of 4180 2712 msedge.exe 85 PID 2712 wrote to memory of 4180 2712 msedge.exe 85 PID 2712 wrote to memory of 4180 2712 msedge.exe 85 PID 2712 wrote to memory of 4180 2712 msedge.exe 85 PID 2712 wrote to memory of 4180 2712 msedge.exe 85 PID 2712 wrote to memory of 4180 2712 msedge.exe 85 PID 2712 wrote to memory of 4180 2712 msedge.exe 85 PID 2712 wrote to memory of 4180 2712 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8b9e081803cc60e763c04767e22ec665_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdad846f8,0x7ffcdad84708,0x7ffcdad847182⤵PID:3728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4152032376752112619,13978350136223831053,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:3044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,4152032376752112619,13978350136223831053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,4152032376752112619,13978350136223831053,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:82⤵PID:4180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4152032376752112619,13978350136223831053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:4188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4152032376752112619,13978350136223831053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:4344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4152032376752112619,13978350136223831053,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2124
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4404
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\139b7580-7d80-4b8e-912a-456a41fa4d1a.tmp
Filesize6KB
MD5cae27050bc83827953dc2359af9a3be1
SHA1723c7dff1c900f17c0dd735f07687675856605d7
SHA256ead234c15a8c1b7067404e9aaceb5586f9691a7fbe13c58898453b9de3c98684
SHA5121aea595767d56ce73e2ad0de73b37044bb51e42250ce7d1501eea4ece600b37ecf6bcf323742d617ad3e9931ece6429e8ea5f3588d3d673d9ab73e310cdbb0db
-
Filesize
6KB
MD5613fd4db7bee22d858b11085b9e8c923
SHA1a7f9c933bdbb2000725695c354906441267f7826
SHA256860052fdc965e5893dc7ca0bbd9cbbdb7430e750d03d7781e397c64227c10dee
SHA5128e1768b82a6afcacb46865d0c26d71a045b13d0e691a22dd25e7c6d12371965485d7bdc1ab5fcbed19f7880340e99c10753edda1f1ef82ae7166b167f58d4e77
-
Filesize
5KB
MD5704ab9c3f0d9db5fe7704f07df997c93
SHA1515424df5894f1e2b649ec70fd0f65b50779d831
SHA256f892263210357dc89f8ac0697bb8ed7466cb74a15dd72728d5d4e9b0f107b278
SHA5123ce76d6492645cda13bd35d69e16fe46daca9d32a4c42a1bc21bc8a439d29fd661731868058edc199cb0513e200c50b29fe0b7f3e6f78d114c20a33df9f5e4bf
-
Filesize
11KB
MD50e0dc40ec756ecb9f2341ced5225429b
SHA169bdaa45905291246d8436fc4ac6745aa4dfa83b
SHA256dc5dac6f9fa318a685daaf08cf92b31490af5b153ac252216fc95b3ba107d26b
SHA512f738e4fe87c16df552db6d8dec76a81558746bc97895b92beb3fe464ffd4631be2025d340f130b62eb9292561232275f771ec512a5850723de572d282782e988