Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 05:07
Static task
static1
Behavioral task
behavioral1
Sample
8cfa35de6360824286b5554b422b5378_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8cfa35de6360824286b5554b422b5378_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8cfa35de6360824286b5554b422b5378_JaffaCakes118.html
-
Size
70KB
-
MD5
8cfa35de6360824286b5554b422b5378
-
SHA1
61e5365f0988d00d5e49d0703fc38c4eea196eb3
-
SHA256
acaefc7b2d5e55c3f009dc0775f7ed3170b6a0d7a70be6614311de1f590f91ee
-
SHA512
0f78fb602456cd7fd3f1b9174f70639b8c9a6a7890e5ec36441065243153d6500d620f749151070e3fa94c352c3bf5e826fb0d01ddccd77bb4dfbd47481a748d
-
SSDEEP
768:SAjqM02YpFPDI1HoCvrv75J5zP9nPsrU/SJ/9sNiQpc:SAj10NE1IKV7/SJ/9Z1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2872 msedge.exe 2872 msedge.exe 3020 msedge.exe 3020 msedge.exe 1924 identity_helper.exe 1924 identity_helper.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3020 wrote to memory of 3704 3020 msedge.exe 81 PID 3020 wrote to memory of 3704 3020 msedge.exe 81 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 980 3020 msedge.exe 82 PID 3020 wrote to memory of 2872 3020 msedge.exe 83 PID 3020 wrote to memory of 2872 3020 msedge.exe 83 PID 3020 wrote to memory of 2620 3020 msedge.exe 84 PID 3020 wrote to memory of 2620 3020 msedge.exe 84 PID 3020 wrote to memory of 2620 3020 msedge.exe 84 PID 3020 wrote to memory of 2620 3020 msedge.exe 84 PID 3020 wrote to memory of 2620 3020 msedge.exe 84 PID 3020 wrote to memory of 2620 3020 msedge.exe 84 PID 3020 wrote to memory of 2620 3020 msedge.exe 84 PID 3020 wrote to memory of 2620 3020 msedge.exe 84 PID 3020 wrote to memory of 2620 3020 msedge.exe 84 PID 3020 wrote to memory of 2620 3020 msedge.exe 84 PID 3020 wrote to memory of 2620 3020 msedge.exe 84 PID 3020 wrote to memory of 2620 3020 msedge.exe 84 PID 3020 wrote to memory of 2620 3020 msedge.exe 84 PID 3020 wrote to memory of 2620 3020 msedge.exe 84 PID 3020 wrote to memory of 2620 3020 msedge.exe 84 PID 3020 wrote to memory of 2620 3020 msedge.exe 84 PID 3020 wrote to memory of 2620 3020 msedge.exe 84 PID 3020 wrote to memory of 2620 3020 msedge.exe 84 PID 3020 wrote to memory of 2620 3020 msedge.exe 84 PID 3020 wrote to memory of 2620 3020 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8cfa35de6360824286b5554b422b5378_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb55f646f8,0x7ffb55f64708,0x7ffb55f647182⤵PID:3704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,10666468103875787146,10417568567289922462,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵PID:980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,10666468103875787146,10417568567289922462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,10666468103875787146,10417568567289922462,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2484 /prefetch:82⤵PID:2620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10666468103875787146,10417568567289922462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10666468103875787146,10417568567289922462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:1324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,10666468103875787146,10417568567289922462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:82⤵PID:3284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,10666468103875787146,10417568567289922462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10666468103875787146,10417568567289922462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:12⤵PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10666468103875787146,10417568567289922462,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:12⤵PID:4336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10666468103875787146,10417568567289922462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:12⤵PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10666468103875787146,10417568567289922462,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:12⤵PID:3644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,10666468103875787146,10417568567289922462,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:60
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:692
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
Filesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
Filesize
253B
MD594f1421c2cc7ec94148b554574971657
SHA13fb2abf860d67da7e023a9937f0a61b539adb35f
SHA2562c99664bc90c36b6401ea684ccd589d3e6d4b8e98f203eeb31635dade9ad9bc9
SHA512cece5b79baefc688cdc69fc827e36bc7924711e6203d76b11c98d71d90d1b6acf9a50b09c9aea8b7ef90f9a404cad30512bd980a3dde76e23d066123a27bd42d
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD5c085472b9762e9acc81b1bfcaeac1828
SHA10b144392a9791d30393b686b4204027e85c9b7ff
SHA256e6e2ce702a9d9e3b561acf8aa694c5db5c79ccbd70e3b72fe5871829aec45e10
SHA512e8c5cfc17003d16b6af3b078fbc2c079f60577e2b8655d82f6fcbac1bc71f1f4041dfc0593ef4893fae4c6f019d8124fc9a8c68ea131a3739a261b53491134dc
-
Filesize
6KB
MD564138ecfdbc68ceb20f4a4f5551b5b40
SHA192e4ca635ccccffbb88edc566844b3f7789c314b
SHA256029d901d735808759efbeae568ac3f93f74336c4b5ddd57d42782b23175b8ea4
SHA512f0f78f77b9d88c553dd5a9a4092338d18ebdd2fcda2761a19b2b4e17221367dae41437df41e7fac84e4891ac8c98b777a6177fba4e886b4fb13381979d73663d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD51797684f142ad5c33a875533349f9a86
SHA187a180d11eaa256967f79cbf5421922bced921c3
SHA25621c49f59b9131d9b43c6ea76695b133b1c76ba0b0ec768c047b961952fa88b30
SHA5129e995ba463a7c6474828fa505c6a3e898c4516d85cc2320d79cbc73f94b65214fa4ba97ad712f77da85f4e0ec26e9e0826c762d9df721fa42c12ce82a1a4cfd2