Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 01:39
Static task
static1
Behavioral task
behavioral1
Sample
8c7d2f25e8757feb1d0fab1b4568c2ea_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8c7d2f25e8757feb1d0fab1b4568c2ea_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8c7d2f25e8757feb1d0fab1b4568c2ea_JaffaCakes118.html
-
Size
139KB
-
MD5
8c7d2f25e8757feb1d0fab1b4568c2ea
-
SHA1
4afec5c8d2766bb295f6e9f14ff8607d66e0f813
-
SHA256
4608c5e84d886122c03c027c16aab11979a05a8cc425f68ee18b0e71a2e51d4b
-
SHA512
444a0960e5e30e78352bd5370dbb884601f57fcbe8cbbb5b750b2531e5299c1874a70a798cd8fbbc31397808b69d6876fdb101498849f7e12f4d03ceb233a8ab
-
SSDEEP
1536:S3NMe/ARlzkyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:S3ofkyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4988 msedge.exe 4988 msedge.exe 1344 msedge.exe 1344 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1344 msedge.exe 1344 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1344 wrote to memory of 100 1344 msedge.exe 83 PID 1344 wrote to memory of 100 1344 msedge.exe 83 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 3136 1344 msedge.exe 84 PID 1344 wrote to memory of 4988 1344 msedge.exe 85 PID 1344 wrote to memory of 4988 1344 msedge.exe 85 PID 1344 wrote to memory of 4732 1344 msedge.exe 86 PID 1344 wrote to memory of 4732 1344 msedge.exe 86 PID 1344 wrote to memory of 4732 1344 msedge.exe 86 PID 1344 wrote to memory of 4732 1344 msedge.exe 86 PID 1344 wrote to memory of 4732 1344 msedge.exe 86 PID 1344 wrote to memory of 4732 1344 msedge.exe 86 PID 1344 wrote to memory of 4732 1344 msedge.exe 86 PID 1344 wrote to memory of 4732 1344 msedge.exe 86 PID 1344 wrote to memory of 4732 1344 msedge.exe 86 PID 1344 wrote to memory of 4732 1344 msedge.exe 86 PID 1344 wrote to memory of 4732 1344 msedge.exe 86 PID 1344 wrote to memory of 4732 1344 msedge.exe 86 PID 1344 wrote to memory of 4732 1344 msedge.exe 86 PID 1344 wrote to memory of 4732 1344 msedge.exe 86 PID 1344 wrote to memory of 4732 1344 msedge.exe 86 PID 1344 wrote to memory of 4732 1344 msedge.exe 86 PID 1344 wrote to memory of 4732 1344 msedge.exe 86 PID 1344 wrote to memory of 4732 1344 msedge.exe 86 PID 1344 wrote to memory of 4732 1344 msedge.exe 86 PID 1344 wrote to memory of 4732 1344 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8c7d2f25e8757feb1d0fab1b4568c2ea_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c93a46f8,0x7ff8c93a4708,0x7ff8c93a47182⤵PID:100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,17112832550842792859,9459345112896385549,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,17112832550842792859,9459345112896385549,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,17112832550842792859,9459345112896385549,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:82⤵PID:4732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17112832550842792859,9459345112896385549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:2100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17112832550842792859,9459345112896385549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:3576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,17112832550842792859,9459345112896385549,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2996
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3488
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\180fb952-877c-410e-a3bc-79ab0cd15660.tmp
Filesize5KB
MD5b41574c26d220844a765019f4147381f
SHA1b964af890ef9aee95dcc20a2489d210104295a86
SHA256945d444241027f7ffafbb4e8c64d5eeae0093b06901d6bcdf267fa3dfd017ac6
SHA51272776544d4f02deee2b0b7ebc21d06ad25caa8e17b60e1007b434e57860ea2c08dc65c8c9587cc78ecc2fbafda814dfb699b6850bf84b55fd3af508c877b0286
-
Filesize
6KB
MD57ea70c27c7c46ef6bfb54f726c49704c
SHA113028ed00f7ae3bb63aa7c04d50963890cde7b4e
SHA256e81b6def12430de8b9cc89f1d7f04762e884ac5f96239247c273325b8fbc1a9d
SHA5128e18c70841434c0526595dd1354ee4cfcbc730e8173a2dff41ad92ae87715b3ab8bcf439d98bd1cf4b00918a09a5bb593e1ba41ebf60e3210765cd7fa06367e7
-
Filesize
10KB
MD5084f4690d283c3f572b8bff5caabfced
SHA1d2d8578cc97b25211189504c0fb3f86206dfeaa8
SHA25677ba0e5ccdbabfaa2329bc0e643b84a4e64bb308229ed09a12cde9afd4053fc0
SHA512df2ede2650eb0a2888b40ec8bd544e1f7a1e033dcfd30e5c84e9bb87948f36739a19d7ec2f36aaad4eabf377bcee867ce316ea5e2df7047123f99eec256669a6