Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 01:02
Static task
static1
Behavioral task
behavioral1
Sample
8c6663e4ba8fe3c7c5e7c583cf20da82_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
8c6663e4ba8fe3c7c5e7c583cf20da82_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8c6663e4ba8fe3c7c5e7c583cf20da82_JaffaCakes118.html
-
Size
232KB
-
MD5
8c6663e4ba8fe3c7c5e7c583cf20da82
-
SHA1
2b1cea1b319b6909c7276c3084c3ae3c080d8b12
-
SHA256
d5d82b15fe4c8360bf88d12d574fc5af045ea631983ef0daeec62ea25ef86843
-
SHA512
02a285fae2b5d8b25490064820853489d77e2a279e17cc2a3f2007a7162b6c18b5b94602b70b9db85baab231accbd82417771006338a3c5f9738e91901c6efdc
-
SSDEEP
3072:+JsCCodiQuzqejpKjlU/a3HoS77Y0CrMH43A8:wueejnaYUWZ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2364 msedge.exe 2364 msedge.exe 1540 msedge.exe 1540 msedge.exe 744 identity_helper.exe 744 identity_helper.exe 2852 msedge.exe 2852 msedge.exe 2852 msedge.exe 2852 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1540 wrote to memory of 2664 1540 msedge.exe 81 PID 1540 wrote to memory of 2664 1540 msedge.exe 81 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2288 1540 msedge.exe 82 PID 1540 wrote to memory of 2364 1540 msedge.exe 83 PID 1540 wrote to memory of 2364 1540 msedge.exe 83 PID 1540 wrote to memory of 2600 1540 msedge.exe 84 PID 1540 wrote to memory of 2600 1540 msedge.exe 84 PID 1540 wrote to memory of 2600 1540 msedge.exe 84 PID 1540 wrote to memory of 2600 1540 msedge.exe 84 PID 1540 wrote to memory of 2600 1540 msedge.exe 84 PID 1540 wrote to memory of 2600 1540 msedge.exe 84 PID 1540 wrote to memory of 2600 1540 msedge.exe 84 PID 1540 wrote to memory of 2600 1540 msedge.exe 84 PID 1540 wrote to memory of 2600 1540 msedge.exe 84 PID 1540 wrote to memory of 2600 1540 msedge.exe 84 PID 1540 wrote to memory of 2600 1540 msedge.exe 84 PID 1540 wrote to memory of 2600 1540 msedge.exe 84 PID 1540 wrote to memory of 2600 1540 msedge.exe 84 PID 1540 wrote to memory of 2600 1540 msedge.exe 84 PID 1540 wrote to memory of 2600 1540 msedge.exe 84 PID 1540 wrote to memory of 2600 1540 msedge.exe 84 PID 1540 wrote to memory of 2600 1540 msedge.exe 84 PID 1540 wrote to memory of 2600 1540 msedge.exe 84 PID 1540 wrote to memory of 2600 1540 msedge.exe 84 PID 1540 wrote to memory of 2600 1540 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8c6663e4ba8fe3c7c5e7c583cf20da82_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb93be46f8,0x7ffb93be4708,0x7ffb93be47182⤵PID:2664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1784980232122762472,4617032061483449267,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵PID:2288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,1784980232122762472,4617032061483449267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,1784980232122762472,4617032061483449267,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:2600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1784980232122762472,4617032061483449267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1784980232122762472,4617032061483449267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:3888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,1784980232122762472,4617032061483449267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:82⤵PID:1832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,1784980232122762472,4617032061483449267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1784980232122762472,4617032061483449267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:12⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1784980232122762472,4617032061483449267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:12⤵PID:1320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1784980232122762472,4617032061483449267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:12⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1784980232122762472,4617032061483449267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:12⤵PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1784980232122762472,4617032061483449267,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2852
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1860
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
185B
MD594810fb3da2f87ca285d413bfbcad0df
SHA19d404e58e77b53933b85f29e8ae30e4404a4eb68
SHA2562d698c2f696c83e1f4bcedd7d53c7efc123f41d3328847a0e83fea4a59e26f88
SHA512d39875025d8c37fb41f4173fe12bab9ccbbf71eb5bdcb7e25fe78de4ab1c1bbfff1fc94695f200cc6be64a39c6bf4bd14fcf9a46c2220eaac9dc108cbcb47ee3
-
Filesize
5KB
MD5b8bcca650e66e2b58eb3814b29fe1aef
SHA14a1d5d627509199d3ed7cdf971ca1a0da9c0771d
SHA256eef68cbb9a81e6a19afa833ddb845ef6d56c546aa15ad2b45fba6c67e2f1ade8
SHA5127deda8819840e51b98b3c38f55831717886e00c3c3397e0d2b3b7f910610b1fbb6a751f3641c2e498d111555d89cb5e3cfb419fba60c60a629995245685bcc4a
-
Filesize
6KB
MD5f0dcfe99ead52129b0b305ef195a984e
SHA116ba802b3bb5411a284f1c98a66636f3ca8ca5fb
SHA256daa3e280f53d4b581d9f9fd764ce1f2c57edb79a483bc937e7fd0e62e17d6f6e
SHA5127f6431ac84a021b8e90d8768c835919f2f42a275122350d407f81795def9becac20f70744763c5b0c6637cea1846f2dafd9ec75dc50e0b16f8b70d56fc2b8cb1
-
Filesize
6KB
MD50154635500fe842b168c63e0def2d334
SHA1ceebe0d35d4bd10ba608c7f24a6a8024024d6e7d
SHA25681f3ab19b10b61afa2fb614b14b23d7ad1ff837e7ac059501ffbbcc0a4688497
SHA512284fed61f8fd5240f9d53dee70c5e02ca1c7e208077a38961cbd78b19961c292c7b6309664d02c6eb509661d1100efef005cfb3ee340c32bef7a68187561111f
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD58f2d4acd8cf42d392c4a61c0aff72ad5
SHA16556be14a4c5260c9b377fcb4eb7330fb44a7371
SHA256b59bee7a0e1f7b99ac59faafea429150594c446a489dce7e320e99e2de268c7a
SHA51252370f334264982f1dbf59a7b872835aec379a620e755838de3f5c99e4ba29e214403adccd58477d583d6966ec66e4954dd3205a8e82005421516ce386f178e4