Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 20:07
Static task
static1
Behavioral task
behavioral1
Sample
8ba01884786db21554228f4f07a43a90_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8ba01884786db21554228f4f07a43a90_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8ba01884786db21554228f4f07a43a90_JaffaCakes118.html
-
Size
496B
-
MD5
8ba01884786db21554228f4f07a43a90
-
SHA1
83807d967e96657c640845b17dde7b80f6e7a35f
-
SHA256
433b5b37e917ae98a1fbc86744834a6dd1889314ca6833747f57191af90d891e
-
SHA512
95307d0d240dfb3c21a7ea0dfc6cb4ee093fd8b112ac641dd09cc165b62943a6fb08a5bff781f2379494f1c05b5f58f3670fb23f87cd553ae7dccce54df63abd
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2320 msedge.exe 2320 msedge.exe 3064 msedge.exe 3064 msedge.exe 4708 identity_helper.exe 4708 identity_helper.exe 3672 msedge.exe 3672 msedge.exe 3672 msedge.exe 3672 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3064 wrote to memory of 1172 3064 msedge.exe 81 PID 3064 wrote to memory of 1172 3064 msedge.exe 81 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 4388 3064 msedge.exe 82 PID 3064 wrote to memory of 2320 3064 msedge.exe 83 PID 3064 wrote to memory of 2320 3064 msedge.exe 83 PID 3064 wrote to memory of 3724 3064 msedge.exe 84 PID 3064 wrote to memory of 3724 3064 msedge.exe 84 PID 3064 wrote to memory of 3724 3064 msedge.exe 84 PID 3064 wrote to memory of 3724 3064 msedge.exe 84 PID 3064 wrote to memory of 3724 3064 msedge.exe 84 PID 3064 wrote to memory of 3724 3064 msedge.exe 84 PID 3064 wrote to memory of 3724 3064 msedge.exe 84 PID 3064 wrote to memory of 3724 3064 msedge.exe 84 PID 3064 wrote to memory of 3724 3064 msedge.exe 84 PID 3064 wrote to memory of 3724 3064 msedge.exe 84 PID 3064 wrote to memory of 3724 3064 msedge.exe 84 PID 3064 wrote to memory of 3724 3064 msedge.exe 84 PID 3064 wrote to memory of 3724 3064 msedge.exe 84 PID 3064 wrote to memory of 3724 3064 msedge.exe 84 PID 3064 wrote to memory of 3724 3064 msedge.exe 84 PID 3064 wrote to memory of 3724 3064 msedge.exe 84 PID 3064 wrote to memory of 3724 3064 msedge.exe 84 PID 3064 wrote to memory of 3724 3064 msedge.exe 84 PID 3064 wrote to memory of 3724 3064 msedge.exe 84 PID 3064 wrote to memory of 3724 3064 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8ba01884786db21554228f4f07a43a90_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1e8a46f8,0x7fff1e8a4708,0x7fff1e8a47182⤵PID:1172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6276798696042273921,2250611820582078299,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,6276798696042273921,2250611820582078299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,6276798696042273921,2250611820582078299,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵PID:3724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6276798696042273921,2250611820582078299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:1200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6276798696042273921,2250611820582078299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6276798696042273921,2250611820582078299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1944 /prefetch:12⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,6276798696042273921,2250611820582078299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3528 /prefetch:82⤵PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,6276798696042273921,2250611820582078299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3528 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6276798696042273921,2250611820582078299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:12⤵PID:3660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6276798696042273921,2250611820582078299,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:12⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6276798696042273921,2250611820582078299,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2780 /prefetch:12⤵PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6276798696042273921,2250611820582078299,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5468 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3672
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3216
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD55f0231c1a972cdf2bce2b7a1b7098a36
SHA1ac146c808e199b30a22595d139826608f40f1562
SHA256219a8cf97560daf6e9d457705a6cbc3ce245896cace1b37c1f7c6c9dbf7b8a40
SHA5120aa3a22f8e954ec8044decc42ee17802de42e810c652e71bf29abcfb9a1b77a76fad7763bf6c519a1a579965778e7396b0d236fead0e8c75359d7eff4f867488
-
Filesize
152B
MD5537815e7cc5c694912ac0308147852e4
SHA12ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA51263969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
-
Filesize
152B
MD58b167567021ccb1a9fdf073fa9112ef0
SHA13baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA25626764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\79b90e51-43de-491e-aecc-9111cc763809.tmp
Filesize5KB
MD53f5965b61c0e0131b8f5349398395e17
SHA1f5c6e713963bbcf42ffd1eb845c11abe4eda4e0f
SHA256eac3226a0aae5e3b3851a310923ac9fc5be6bc333ca6d6c265ff356dd6e213cd
SHA512458979584577a9441a527c2dc0fdd8e999354f29b350416cd01761765c4afdd3d01f5be058c7bb9e7d8a895febf72212b18901702c2c9cd28db9a19c9c5f5099
-
Filesize
6KB
MD583690af9ffef6e3fd42a343f004123fe
SHA1417d3aa2891ab42ebd4d196ae7cb33f73089d54b
SHA25671bbb04fd43f6639c7b5a8c3c9406ac833380bb7a5905e17b121968a4967ae1f
SHA5123c542c5bd74c6274ae791b3fd383f67d4bb32bd3cf648ada05bef131ce7428d83bae6433603c527dab2a9cf56f0a4e139feac8dca950c9e27dbc54e817a7d10d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389