Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 23:10
Static task
static1
Behavioral task
behavioral1
Sample
8fc235f0217eb67c17325ffad7741edf_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8fc235f0217eb67c17325ffad7741edf_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8fc235f0217eb67c17325ffad7741edf_JaffaCakes118.html
-
Size
32KB
-
MD5
8fc235f0217eb67c17325ffad7741edf
-
SHA1
c8a83344314fc7b4b6343af0c4ca5104808a11d9
-
SHA256
905ab3dd829720ed299295b28793f408a98d56b5defa8bc410c53226dda600b9
-
SHA512
08b86aadcf29c1f506aa8650468b2a330c57a2de974fffe185c8d183a40ecc347c956a645e4a591033ebadd30f7de26ded42e41426aef446503330d1cf1ef798
-
SSDEEP
768:VLpC+hgVCEgGEPQ+d3I1Mhiuzxtv2SRUEq:V9CLCECMgxtU
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4572 msedge.exe 4572 msedge.exe 1228 msedge.exe 1228 msedge.exe 4484 identity_helper.exe 4484 identity_helper.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe 1228 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1228 wrote to memory of 1564 1228 msedge.exe 83 PID 1228 wrote to memory of 1564 1228 msedge.exe 83 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4388 1228 msedge.exe 84 PID 1228 wrote to memory of 4572 1228 msedge.exe 85 PID 1228 wrote to memory of 4572 1228 msedge.exe 85 PID 1228 wrote to memory of 1692 1228 msedge.exe 86 PID 1228 wrote to memory of 1692 1228 msedge.exe 86 PID 1228 wrote to memory of 1692 1228 msedge.exe 86 PID 1228 wrote to memory of 1692 1228 msedge.exe 86 PID 1228 wrote to memory of 1692 1228 msedge.exe 86 PID 1228 wrote to memory of 1692 1228 msedge.exe 86 PID 1228 wrote to memory of 1692 1228 msedge.exe 86 PID 1228 wrote to memory of 1692 1228 msedge.exe 86 PID 1228 wrote to memory of 1692 1228 msedge.exe 86 PID 1228 wrote to memory of 1692 1228 msedge.exe 86 PID 1228 wrote to memory of 1692 1228 msedge.exe 86 PID 1228 wrote to memory of 1692 1228 msedge.exe 86 PID 1228 wrote to memory of 1692 1228 msedge.exe 86 PID 1228 wrote to memory of 1692 1228 msedge.exe 86 PID 1228 wrote to memory of 1692 1228 msedge.exe 86 PID 1228 wrote to memory of 1692 1228 msedge.exe 86 PID 1228 wrote to memory of 1692 1228 msedge.exe 86 PID 1228 wrote to memory of 1692 1228 msedge.exe 86 PID 1228 wrote to memory of 1692 1228 msedge.exe 86 PID 1228 wrote to memory of 1692 1228 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8fc235f0217eb67c17325ffad7741edf_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb7ba46f8,0x7ffcb7ba4708,0x7ffcb7ba47182⤵PID:1564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12130185418430324054,1052921064294233299,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,12130185418430324054,1052921064294233299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,12130185418430324054,1052921064294233299,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:82⤵PID:1692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12130185418430324054,1052921064294233299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:2468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12130185418430324054,1052921064294233299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:12⤵PID:2276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12130185418430324054,1052921064294233299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:12⤵PID:2804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12130185418430324054,1052921064294233299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:82⤵PID:2024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12130185418430324054,1052921064294233299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12130185418430324054,1052921064294233299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:12⤵PID:3180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12130185418430324054,1052921064294233299,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:12⤵PID:1344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12130185418430324054,1052921064294233299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:12⤵PID:2272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12130185418430324054,1052921064294233299,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:12⤵PID:2540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12130185418430324054,1052921064294233299,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3604 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3488
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:412
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
Filesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD5530086ca5b5c8cd9f42b5fedfc824d32
SHA15ded5459355a586044dbffc129ebbddb127ae8a2
SHA256394f354f2c1db519808addafdb24e9ba4f69746388afc7126afa6ac348bc73e7
SHA5120f9247665a3f3504ea3ab75eeeae30e0e3f49bd1590a170383811376739d05d70ae00d8da0f484eaf6e30bfbf5446836a40e484effb61ec57eac29886e2fb0cb
-
Filesize
2KB
MD59523f4c9e9a966eead86b7dca2077fde
SHA1b56b2bc7fed2529e887e101916659740beb10f8d
SHA256cb70798b4522a4b391f2b8ed7e0ceb5d750cccb4d7cbd6d118cc243867150e3a
SHA512004b6d7cc18195fae2cbde463c7ac7fa61f74d945740cf2fca9a5ae906d5062e929df8222647fc687e03ba77f9a88788447086e6b7e7e7322818c9eefcf0cea8
-
Filesize
6KB
MD57650fb9a240e1d278f76c4a44245ec5c
SHA161a69c2e036d93503e8fa31d3295ede1ad3f44da
SHA2561dbd4c6465b8da53aaab08a74d8c13f623b6a5be10402a38148b7b24d2537100
SHA512962f3bb2ec4ed1207b770b32ac10b8280617c474b3e063d9f59ab90f4a8ebf5be7507a67d42c8dfa3fef8f1c0f771937605e186958af701382c11d899de250a2
-
Filesize
5KB
MD5971c1037ff268c98317bc6cdfbc83968
SHA1bf45d0722f41a436bfd060fc1d5784cb1120622f
SHA2561ab1d868a204987c5e2b57352be82bae5645f37e42d534b4f68c3f80e16c16d7
SHA512d8450e90f6a267cb0752b9aeb7b9ae87672d4cf482944ca61cbb92bcb3aeeb32cf4c86eb9e2851dca1dd868c4603b8726f347a4bb604475210a46908d11737c7
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD50d11f30daa1c4fd88db6bbcc7425521b
SHA13181ae96d765ca049a7a262202bb37bbc4f41d35
SHA256ade7d0510a0bc65ec0b9d966244da00a84cb44fd9aa2034737490ec78f2c732e
SHA512cc8f351b788c802d778d0e903c4e4eb650235792a7f028e2d6162de30a2fa210fa18c98f54c9f11e744f87ecc3f3d18d77e3dbf819ef578e0b5dc532fea9e444