Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 04:47
Static task
static1
Behavioral task
behavioral1
Sample
8cedb6658c589aaf6483512e9f3c00e2_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
8cedb6658c589aaf6483512e9f3c00e2_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8cedb6658c589aaf6483512e9f3c00e2_JaffaCakes118.html
-
Size
68KB
-
MD5
8cedb6658c589aaf6483512e9f3c00e2
-
SHA1
1d105c991cda1ce153221d0d95f2c3c3b45b37dc
-
SHA256
dc037df74ce14e4e7931e91a1ce2ea36fffc21d4ef13805e7c52d4ac882c017b
-
SHA512
be3d8c74f265c7ee4a0c2e8a5246bc69d59e85b29ee8a76a2d35306773f6fe6d0b6552b06e4f94990172f1648f656bbea0df23fed3ac46100b4dc0735117fb0e
-
SSDEEP
768:JiHgcMiR3sI2PDDnX0g6wNP8DP5T8uCiTjPGoTyv1wCZkoTyMdtbBnfBgN8/lboz:JlNs5ZnXTcNen0tbrga94hcuNnQC
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4464 msedge.exe 4464 msedge.exe 1184 msedge.exe 1184 msedge.exe 852 identity_helper.exe 852 identity_helper.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1184 wrote to memory of 4932 1184 msedge.exe 82 PID 1184 wrote to memory of 4932 1184 msedge.exe 82 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 3452 1184 msedge.exe 83 PID 1184 wrote to memory of 4464 1184 msedge.exe 84 PID 1184 wrote to memory of 4464 1184 msedge.exe 84 PID 1184 wrote to memory of 2872 1184 msedge.exe 85 PID 1184 wrote to memory of 2872 1184 msedge.exe 85 PID 1184 wrote to memory of 2872 1184 msedge.exe 85 PID 1184 wrote to memory of 2872 1184 msedge.exe 85 PID 1184 wrote to memory of 2872 1184 msedge.exe 85 PID 1184 wrote to memory of 2872 1184 msedge.exe 85 PID 1184 wrote to memory of 2872 1184 msedge.exe 85 PID 1184 wrote to memory of 2872 1184 msedge.exe 85 PID 1184 wrote to memory of 2872 1184 msedge.exe 85 PID 1184 wrote to memory of 2872 1184 msedge.exe 85 PID 1184 wrote to memory of 2872 1184 msedge.exe 85 PID 1184 wrote to memory of 2872 1184 msedge.exe 85 PID 1184 wrote to memory of 2872 1184 msedge.exe 85 PID 1184 wrote to memory of 2872 1184 msedge.exe 85 PID 1184 wrote to memory of 2872 1184 msedge.exe 85 PID 1184 wrote to memory of 2872 1184 msedge.exe 85 PID 1184 wrote to memory of 2872 1184 msedge.exe 85 PID 1184 wrote to memory of 2872 1184 msedge.exe 85 PID 1184 wrote to memory of 2872 1184 msedge.exe 85 PID 1184 wrote to memory of 2872 1184 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8cedb6658c589aaf6483512e9f3c00e2_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe730346f8,0x7ffe73034708,0x7ffe730347182⤵PID:4932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7608795896010686628,8373584408106303750,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:3452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7608795896010686628,8373584408106303750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7608795896010686628,8373584408106303750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:82⤵PID:2872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7608795896010686628,8373584408106303750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7608795896010686628,8373584408106303750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:4456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7608795896010686628,8373584408106303750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:12⤵PID:2128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7608795896010686628,8373584408106303750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:82⤵PID:3716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7608795896010686628,8373584408106303750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7608795896010686628,8373584408106303750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:12⤵PID:3752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7608795896010686628,8373584408106303750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:12⤵PID:2124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7608795896010686628,8373584408106303750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:12⤵PID:3356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7608795896010686628,8373584408106303750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:3880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7608795896010686628,8373584408106303750,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1900 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1344
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3244
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4072
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5c195236a2775524185de65cf159881c5
SHA1f6d314c3a7a3854237c489ebf880bd5541d630f6
SHA25694d6c158df5fbdb1fdd91a3f7f019e16796c3a879046bd319f1c1b51a3eccce4
SHA5128fc9b1ee9f8a3131d83f8fd11effd6a86dfac23a680cc755ccaebe01b792ddd410f165dbf23f64f89a4103668daa72546c8a63e85d55e58e47f6995ea4ac6fbd
-
Filesize
409B
MD5d978f7d7ccf4a6fb27282f1a48c5d219
SHA177b12a2a51cc6980340ae0a67fa2a5c6164fbbc9
SHA2563f0c4d9d6a296aee05a8c3a6b5106e60b537450a179c86fdadae314bf88cea9c
SHA512906890f034d1183a54d9632d8b7d4e55b9bf6d343c7c8229ff600479c1a450e5b1e079f8a552aa71dc36c9aac10ff5b768f37313c82633a73948996bd7579d71
-
Filesize
5KB
MD5e0bf2ca85e5a27cbfd05c4db21fa2e36
SHA17b6b95e51620f8586b8d67cd94d1c18102ab0762
SHA256a82306e8950093a40f242af3e842dac18fe6075af6c8fcd314752241b04cc970
SHA512b99884eb6365c09315e70e06f229ed7ed37cf123e638273fd2da2e113c4019918c220a14f59a125d9c697444ab91a7baffa838e458f64758508e63139915e81d
-
Filesize
6KB
MD5b3855eac6f1207d36e5c224118166c25
SHA1aa400a4e026b323f1d87ba75289690111b071b8d
SHA256ce7a064056c410a2d06f8f802002f4bf5d824d2eaa7904db305b12b9e1bedabb
SHA512af5c86d4645b6881ec5376d16b30957ca311dc12270ceca3e7fee62566681819d105ba3f5e41c690811ad80d74811f2bf494de22527b33805110f935714751c1
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD52ed00c008ddaa6d6c82f1e1204d6f9bb
SHA1e41f8d546b682ea65aaf08d80f2dffa7222e72d1
SHA256da67adfd71f17c24b77b55fcf3bb6f7c4812f9e027d6dcf650fdf40588fa5bff
SHA512b9cdd16e1748ae8a1c4a9af03955dcfc9ab2468871fabc7907fff72072b35c7ee24ecafbec25f18612b5a351a102a138ba3e76a88a42bb9fe98c9ba05fd794e3