Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 07:57
Static task
static1
Behavioral task
behavioral1
Sample
91079036c6fb77396db3ab37faf44afb_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
91079036c6fb77396db3ab37faf44afb_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
91079036c6fb77396db3ab37faf44afb_JaffaCakes118.html
-
Size
70KB
-
MD5
91079036c6fb77396db3ab37faf44afb
-
SHA1
9d4ac07fb9fb382e2b93444737d98fdba0523318
-
SHA256
912f7cce8f109d68df86922cc74c1bb84693e02e5b2079ddb42fd4c930ca659b
-
SHA512
0d7da207ba12e2041e9ff1fd33ea75a0b9b6d013f4387b384a0d06c5f3350f099aa99e851d9686f6711a5dee6770380a36a2f833dfa44704d0cf229f20b3b131
-
SSDEEP
1536:LFvnqgV55yNot2jSn9qpCIZ00i7uwGdA+BaTCyhodoLlKMtV1:5vnF5Got2jdpCIrwGdIGOodoLlKMtV1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2460 msedge.exe 2460 msedge.exe 4276 msedge.exe 4276 msedge.exe 4772 identity_helper.exe 4772 identity_helper.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe 4276 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4276 wrote to memory of 1968 4276 msedge.exe 82 PID 4276 wrote to memory of 1968 4276 msedge.exe 82 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 1724 4276 msedge.exe 83 PID 4276 wrote to memory of 2460 4276 msedge.exe 84 PID 4276 wrote to memory of 2460 4276 msedge.exe 84 PID 4276 wrote to memory of 4408 4276 msedge.exe 85 PID 4276 wrote to memory of 4408 4276 msedge.exe 85 PID 4276 wrote to memory of 4408 4276 msedge.exe 85 PID 4276 wrote to memory of 4408 4276 msedge.exe 85 PID 4276 wrote to memory of 4408 4276 msedge.exe 85 PID 4276 wrote to memory of 4408 4276 msedge.exe 85 PID 4276 wrote to memory of 4408 4276 msedge.exe 85 PID 4276 wrote to memory of 4408 4276 msedge.exe 85 PID 4276 wrote to memory of 4408 4276 msedge.exe 85 PID 4276 wrote to memory of 4408 4276 msedge.exe 85 PID 4276 wrote to memory of 4408 4276 msedge.exe 85 PID 4276 wrote to memory of 4408 4276 msedge.exe 85 PID 4276 wrote to memory of 4408 4276 msedge.exe 85 PID 4276 wrote to memory of 4408 4276 msedge.exe 85 PID 4276 wrote to memory of 4408 4276 msedge.exe 85 PID 4276 wrote to memory of 4408 4276 msedge.exe 85 PID 4276 wrote to memory of 4408 4276 msedge.exe 85 PID 4276 wrote to memory of 4408 4276 msedge.exe 85 PID 4276 wrote to memory of 4408 4276 msedge.exe 85 PID 4276 wrote to memory of 4408 4276 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91079036c6fb77396db3ab37faf44afb_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84d3746f8,0x7ff84d374708,0x7ff84d3747182⤵PID:1968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8575406683078321778,2842523044732557449,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:1724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,8575406683078321778,2842523044732557449,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,8575406683078321778,2842523044732557449,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:82⤵PID:4408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8575406683078321778,2842523044732557449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8575406683078321778,2842523044732557449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:3488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8575406683078321778,2842523044732557449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:12⤵PID:3504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8575406683078321778,2842523044732557449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:12⤵PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8575406683078321778,2842523044732557449,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:82⤵PID:5108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8575406683078321778,2842523044732557449,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8575406683078321778,2842523044732557449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:12⤵PID:4472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8575406683078321778,2842523044732557449,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:12⤵PID:2344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8575406683078321778,2842523044732557449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:12⤵PID:3680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8575406683078321778,2842523044732557449,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:12⤵PID:2864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8575406683078321778,2842523044732557449,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3148 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5032
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2228
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4244
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
Filesize
1KB
MD531de821a68c74c0fd8a9802110998d37
SHA1dcc73cd299bf2270b06b1a37b892bba23852019b
SHA256d5da059e379ec6e43f4b4047c06e5fd7306eab485db1ad9e8543069b025821f9
SHA512e579281bbc4ca54134c4db60a4b70d687ad0880702339a593045148d0829eafb1a9d3d6395b25d5c4dd3feca8fba8d1e4cc1fe2f49fabccfc23ac2ae9bc4783d
-
Filesize
5KB
MD58c7e8ff1a5a408013a53703199fc1210
SHA122235eac54dc4da1dba14bc3e2f77ee13114ab73
SHA2569417ac90583585e55591b2efbc8902170211f85cf3615921801e4c7fb8e91b3c
SHA512582a97a18c9fb137da99ad0c515f3d1c89a71d2f941c96bcff483a803fa243c01b3c869d02511b97948ce4d82436c820714e3640b147a4d92a5f9eb258bb636d
-
Filesize
6KB
MD5938b1befbc6784d22bcb780c0c59e9fa
SHA110c90f337d07d1ccbd583353b0e61f15c0cfe13a
SHA25605c832409043acf601a6f1a7cea60ac0906425d2e0e256ab2f3ec294603c823b
SHA512d995fed457800917ca47c5186b1b207ecae368b9167d7e9d98952af837ad8cfcc57e7f3a59215e3477782737c413675110026496bda13338d26696d73d2f40be
-
Filesize
6KB
MD599f236764502cdf2e2911475d047d645
SHA16a4697cf27bc803a2e918f444f9760d9cd91db2c
SHA2564973f1d138e5fe98462388b138120dffdad3465e25e07ebc1f109d717a67b054
SHA5129869fff51eb450d2f2eef0d996a0f3664cca4e28c629f058ef79440d62c7810aea34e9abd1bfac47bd54370617bc1595e26c789464d848993f91f9ea552a7b79
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5da18b65b8917223eb0d359a4f56b3883
SHA19fbc3ea3b97244ede77bd6b6849cc1d0e153a174
SHA25664fd187fb0162e2cb0455c93546cfcdca4468dc94a3c775496cba7fda18308e8
SHA512ee6b9c20f147d136e7e535ab0492f1968a580af82aa5df0e15c0962ba498161d1a831e6bc011b0723fe9dcf71a6913302f763e8cf061ef558310d4cfd1e36b9b