Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 23:09
Static task
static1
Behavioral task
behavioral1
Sample
8fc1d43fffbfbc039302c00307e3a1f2_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
8fc1d43fffbfbc039302c00307e3a1f2_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8fc1d43fffbfbc039302c00307e3a1f2_JaffaCakes118.html
-
Size
139KB
-
MD5
8fc1d43fffbfbc039302c00307e3a1f2
-
SHA1
b112d2922dfd1f5bc2e34050da2dfa70b26e5ed8
-
SHA256
eb608d7e24e928f728746ff1081b614048bc637054d50cd0f62370575bf96349
-
SHA512
b408cbf5c6dc6b5b276eed1c7684e4c82f192303b49271765a3e52c140536a806f1199014887267bc91bc5b613e05335ef7e3e8ca2088a46e08ed0833c0f7ca0
-
SSDEEP
3072:ScHwdwjfFyfkMY+BES09JXAnyrZalI+YQ:ScHRfwsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2904 msedge.exe 2904 msedge.exe 3480 msedge.exe 3480 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3480 msedge.exe 3480 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3480 wrote to memory of 4664 3480 msedge.exe 83 PID 3480 wrote to memory of 4664 3480 msedge.exe 83 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 2904 3480 msedge.exe 85 PID 3480 wrote to memory of 2904 3480 msedge.exe 85 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8fc1d43fffbfbc039302c00307e3a1f2_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc65f46f8,0x7ffdc65f4708,0x7ffdc65f47182⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1649739176211345051,2347322576544457112,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:22⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,1649739176211345051,2347322576544457112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,1649739176211345051,2347322576544457112,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵PID:1336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1649739176211345051,2347322576544457112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1649739176211345051,2347322576544457112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1649739176211345051,2347322576544457112,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2624
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4592
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
6KB
MD5be4a5b31bac38c0693de9f67f7d9128e
SHA1c473cfb204b2cd4bed54931d05d3df7549c05f30
SHA256fda8d106e987c536c38285d3ae257a119252ab934f446fbc99000ef976d85aad
SHA512cedda9aabecea14a4208ad1c944d40224e707e6853f4d61b6373a8bbeaea2cd7b57f8e990f18cea618d5d588963d37e11e7c98685ef1b25d4fdb0e1d67c672f6
-
Filesize
5KB
MD50b07b7031b2c985a644d406576c2581d
SHA13d6747fca24a7d26906122a9f29a073d1c79867a
SHA2560ff506f424f6e9e0a656cde17a2791e994049193ddaa5da1cfbc8ef8a0eaa62f
SHA51248ace3302555206ecfcb324a88d7bcb295441307192761fe7ca4e5d2869c754726edbf660a4b8688e959980f4078d75d6e983bbcf9c8bb7ea148cbd8bebc3f94
-
Filesize
11KB
MD515a04d05c1454c083c3fa1c48ace2e29
SHA1a59d2ea08f078e2c9e62287595c15e15dfcb6236
SHA256295d1b3c7d21f377706e753c1a741872b2e380902eafbd3ec430f9d411b0b46d
SHA512a1c5220d7b2b758512f507243148262a432cc2b997d5757dcc92d94696a0456e221751cd3a0360d5f77eaaf73426ffd9c625637ddba56afa00e3cab05e05e747