Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 01:03
Static task
static1
Behavioral task
behavioral1
Sample
8c66d2790151719ad779c2b2dbb4556e_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8c66d2790151719ad779c2b2dbb4556e_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8c66d2790151719ad779c2b2dbb4556e_JaffaCakes118.html
-
Size
53KB
-
MD5
8c66d2790151719ad779c2b2dbb4556e
-
SHA1
998ec7162a189b3de621f89088bda859507df1b1
-
SHA256
b6be022b305651fa3bdea52ace343eed1b52fcd1f49aa94fda65a76f54d1b07e
-
SHA512
b8326bda7b19c87b25501fbb5b7f5c9ae666078dd759d81f03b9b433696b2984790c9b78dcbafd081e40a50148d770c1a7bddf2ac0710de967851352c1e4b057
-
SSDEEP
1536:pELGjG2rOlwX164dlA8ip1h968F9DSCMCDwlQ:VXrOz8ip1h96YtSCMCDwlQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5092 msedge.exe 5092 msedge.exe 4508 msedge.exe 4508 msedge.exe 4356 identity_helper.exe 4356 identity_helper.exe 3776 msedge.exe 3776 msedge.exe 3776 msedge.exe 3776 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4508 wrote to memory of 4752 4508 msedge.exe 84 PID 4508 wrote to memory of 4752 4508 msedge.exe 84 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 812 4508 msedge.exe 86 PID 4508 wrote to memory of 5092 4508 msedge.exe 87 PID 4508 wrote to memory of 5092 4508 msedge.exe 87 PID 4508 wrote to memory of 1172 4508 msedge.exe 88 PID 4508 wrote to memory of 1172 4508 msedge.exe 88 PID 4508 wrote to memory of 1172 4508 msedge.exe 88 PID 4508 wrote to memory of 1172 4508 msedge.exe 88 PID 4508 wrote to memory of 1172 4508 msedge.exe 88 PID 4508 wrote to memory of 1172 4508 msedge.exe 88 PID 4508 wrote to memory of 1172 4508 msedge.exe 88 PID 4508 wrote to memory of 1172 4508 msedge.exe 88 PID 4508 wrote to memory of 1172 4508 msedge.exe 88 PID 4508 wrote to memory of 1172 4508 msedge.exe 88 PID 4508 wrote to memory of 1172 4508 msedge.exe 88 PID 4508 wrote to memory of 1172 4508 msedge.exe 88 PID 4508 wrote to memory of 1172 4508 msedge.exe 88 PID 4508 wrote to memory of 1172 4508 msedge.exe 88 PID 4508 wrote to memory of 1172 4508 msedge.exe 88 PID 4508 wrote to memory of 1172 4508 msedge.exe 88 PID 4508 wrote to memory of 1172 4508 msedge.exe 88 PID 4508 wrote to memory of 1172 4508 msedge.exe 88 PID 4508 wrote to memory of 1172 4508 msedge.exe 88 PID 4508 wrote to memory of 1172 4508 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8c66d2790151719ad779c2b2dbb4556e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd329346f8,0x7ffd32934708,0x7ffd329347182⤵PID:4752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10309251135058162934,1110339063309447367,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,10309251135058162934,1110339063309447367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,10309251135058162934,1110339063309447367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:82⤵PID:1172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10309251135058162934,1110339063309447367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:1736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10309251135058162934,1110339063309447367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10309251135058162934,1110339063309447367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:12⤵PID:4472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,10309251135058162934,1110339063309447367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:82⤵PID:3988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,10309251135058162934,1110339063309447367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10309251135058162934,1110339063309447367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:12⤵PID:1496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10309251135058162934,1110339063309447367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:12⤵PID:2832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10309251135058162934,1110339063309447367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:12⤵PID:3668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10309251135058162934,1110339063309447367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:12⤵PID:3696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10309251135058162934,1110339063309447367,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3776
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3444
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5537815e7cc5c694912ac0308147852e4
SHA12ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA51263969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
-
Filesize
152B
MD58b167567021ccb1a9fdf073fa9112ef0
SHA13baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA25626764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD574b2c641ff28dd8d506e0983b00e5de0
SHA18f874df03b34e45278c95a054de046b539562586
SHA25651c5dc1e30e33883b078cd0ecdb2aa51cd098fc50acb727f81f982b2c4affd73
SHA51226fd8e49a7d5508d7d183fc085eb00cffaeb8cc3da1e27def500dc162f5b775ef452501cae7139e0f7829233cba4a4e8d60fdb5527d9e449ca74b4352d582800
-
Filesize
1KB
MD5ca24848630de3fb60bc9c9e84515d8e9
SHA171122b87995388a2c6eaba504af24f1cb38846ba
SHA256dc226111a3d4f6436d98b89a24e1956f26e6b65fd47c0452a732a6c43a7d39e3
SHA5125455d06ee41dabaed7bc13691cc6babad2b755e5ac548688fb6472a66a1eb631e9f61551258ec26901521fdfbc521f219f26d6a97f89a833f3f7b991eb65d3bf
-
Filesize
6KB
MD5136a6a24cec4aa3325a680d3172d6843
SHA17bc221f15cf9aef3ca901cc68e377875fea32546
SHA2560a751199d3276fcdbd06dc3666cf4c04ec015801762418fe70a4f65a0376dd3a
SHA512b1a44d06acd995d4ea89abd662d17895b8c4cdb570598513e15b3f01c85c2564b0da8b01cf9fc80501c46a934bf3c985fe2f27b87e4c8b66ce6493390f973e5b
-
Filesize
6KB
MD5b4fd7be43e42c16ed10645e0a46cec3a
SHA12c32b33ea098dd3b686b3fb07f9e29ca85498c4b
SHA256ceb04126b3e4ebffde925805fee380bb888b798c1e06b769baeb5dd4f6ec9433
SHA512a9393fefd6cb9bd4f0aab1f558d9d3843c49e2922aadceadf38f4fd40732b1858afd415d68ce07d6968bc2c796b5aa36c6e377e6e5dac83110b4a4ffdcd60534
-
Filesize
5KB
MD503f03166b7c0151de3bc60bdcaa203cf
SHA1565f8ab090e954be7a648cd83632f17c99aaa790
SHA256b8b2457a5758ff7b4190319a3190d23de6f3125db06f855167a5e0dfb3bef135
SHA512ce1d36624f8e38682d48fddd9d9e9aa9a17f38f03b66ca0f312bf41adb0c6b190c6a16af7c084b80cbb4647a2c6b0d3c4f2616c0303e5c3340be615da11524b3
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5147cb6c9b2279c77015d2bc90eac5ab1
SHA1baf8fd5afbfb7aec5b55422f04a8323277bd777f
SHA256cbf4200125f5f0d11f79884c8c4790f1235d3b8b05690bb0579e25a895b3bd4b
SHA512e6268757b30e7c85f0345197b91938cae59b273f3dd02abfd7798c5e3bf576e3291ed39236314a4ff178265e108b372ad781b053c3f9d8bd0d09de8bd17e4c80