Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 07:58
Static task
static1
Behavioral task
behavioral1
Sample
91082ead6e4b3114fdb036a0b1afcbec_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
91082ead6e4b3114fdb036a0b1afcbec_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
91082ead6e4b3114fdb036a0b1afcbec_JaffaCakes118.html
-
Size
45KB
-
MD5
91082ead6e4b3114fdb036a0b1afcbec
-
SHA1
c9ef38343a6903b972a8ad528f25963c2c7f356b
-
SHA256
ca7f0458f7b436493234a0adcc9bbaa5361fe359089c1286b6c2ec16f774de9e
-
SHA512
3ac5fd802af65bbb122ac8d141664f010817ec3353364352d20ce2044877b88ad834608e508a0371f648566a8059cd124919c48116ef46f3f88d776512cf7ab6
-
SSDEEP
384:irSV4SXqfGKRXSD1NWHgODRPPI2HYgPCvT5xqbzgVdzgLEUukrIi7xS4kDL:UX+bD1gAOpPrHCWb8n2EU3zxS4k3
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4564 msedge.exe 4564 msedge.exe 2060 msedge.exe 2060 msedge.exe 4660 identity_helper.exe 4660 identity_helper.exe 5360 msedge.exe 5360 msedge.exe 5360 msedge.exe 5360 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe 2060 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2060 wrote to memory of 1488 2060 msedge.exe 82 PID 2060 wrote to memory of 1488 2060 msedge.exe 82 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 2464 2060 msedge.exe 83 PID 2060 wrote to memory of 4564 2060 msedge.exe 84 PID 2060 wrote to memory of 4564 2060 msedge.exe 84 PID 2060 wrote to memory of 1300 2060 msedge.exe 85 PID 2060 wrote to memory of 1300 2060 msedge.exe 85 PID 2060 wrote to memory of 1300 2060 msedge.exe 85 PID 2060 wrote to memory of 1300 2060 msedge.exe 85 PID 2060 wrote to memory of 1300 2060 msedge.exe 85 PID 2060 wrote to memory of 1300 2060 msedge.exe 85 PID 2060 wrote to memory of 1300 2060 msedge.exe 85 PID 2060 wrote to memory of 1300 2060 msedge.exe 85 PID 2060 wrote to memory of 1300 2060 msedge.exe 85 PID 2060 wrote to memory of 1300 2060 msedge.exe 85 PID 2060 wrote to memory of 1300 2060 msedge.exe 85 PID 2060 wrote to memory of 1300 2060 msedge.exe 85 PID 2060 wrote to memory of 1300 2060 msedge.exe 85 PID 2060 wrote to memory of 1300 2060 msedge.exe 85 PID 2060 wrote to memory of 1300 2060 msedge.exe 85 PID 2060 wrote to memory of 1300 2060 msedge.exe 85 PID 2060 wrote to memory of 1300 2060 msedge.exe 85 PID 2060 wrote to memory of 1300 2060 msedge.exe 85 PID 2060 wrote to memory of 1300 2060 msedge.exe 85 PID 2060 wrote to memory of 1300 2060 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91082ead6e4b3114fdb036a0b1afcbec_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb533746f8,0x7ffb53374708,0x7ffb533747182⤵PID:1488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,2173217422615490006,1663268289619356603,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:22⤵PID:2464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,2173217422615490006,1663268289619356603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,2173217422615490006,1663268289619356603,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:82⤵PID:1300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2173217422615490006,1663268289619356603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:2552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2173217422615490006,1663268289619356603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2173217422615490006,1663268289619356603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:12⤵PID:2196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,2173217422615490006,1663268289619356603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:82⤵PID:824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,2173217422615490006,1663268289619356603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2173217422615490006,1663268289619356603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:12⤵PID:816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2173217422615490006,1663268289619356603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:12⤵PID:2424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2173217422615490006,1663268289619356603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:12⤵PID:1380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2173217422615490006,1663268289619356603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:12⤵PID:3976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,2173217422615490006,1663268289619356603,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5360
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1224
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
Filesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
Filesize
2KB
MD595f21be02cfcc775c9e4fe19f435abb6
SHA12f305fa80c32617a5f3d505705633cdbd0282a66
SHA256cc0750057a906bce925a7f6d6a2d8be52d36324c0f136f5cabc731b8b72ea259
SHA51242b84a66b6fadf795bccf2a1385a2759a91b30d97c8b7689693f6417f59f6b257cee15abde518df918afc70002b5b1a3d2714d754ac09468b2a2502b3cd3e9c9
-
Filesize
5KB
MD5249a02499d76a4dc668aa80603839ce6
SHA154c71b1916889d7090f533723258de6024cbd8af
SHA256a2980cf579863c05bcacafc7a8e00c18710467464d3f80115f41ae96d7779ffe
SHA512a9b3b4c25248c37d9dc40a4cc94c1d85046a89c412dec756581dd5bc8a48eb3ff1a35af478b9dac2a7c89d86e48f72acafd9138dd535b0f60b1ed72817664f09
-
Filesize
7KB
MD55aacfdd5e3cdb221cafc7d937d7fa7a6
SHA1b82961fbd66fe37a176b072ce6f89e0ac3b67dca
SHA256f88b773eb3eaf1a160a82b6ae630116f7252e634715d36de44c0fcd227139c42
SHA512e9d53b4d369423974698d64a72678d1ffea34a41789780384db36cce043a2a00e853f074b6e2f6cc845d2bca1937d911b4ce859f3b065da2faab37fc8cf2bab3
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5647ae3f9fb2c88c7e092caf75d991483
SHA12e1f59555cb708aedca2cba02308f5649eea392c
SHA2565586badea606fc139ff71b5c5a5f2047ecc046818086616f60cbdf94591c4b5b
SHA512b38a8cbef9dfe599f805eb07f0c1a8f62cd98c3ca0c20517153e647ccd2fd401f458a24067e77ab3b22d2f235d7b77ccd0fb8942cf31b0dfa8ce582f280b20cf