Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 07:58
Static task
static1
Behavioral task
behavioral1
Sample
9108047639ffd2b1cf51b7055e7f966d_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9108047639ffd2b1cf51b7055e7f966d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9108047639ffd2b1cf51b7055e7f966d_JaffaCakes118.html
-
Size
89KB
-
MD5
9108047639ffd2b1cf51b7055e7f966d
-
SHA1
bb17d47dab5ce61caa13faa90268d25a63a9e200
-
SHA256
d9db610f3ee680456a5523d706c1fa3d657962573241249dc51279c02fe6a8d0
-
SHA512
466248a25e8a431d993dd40d4fdf3ffbc900b64d612d66a741922205f868cd02142426dc9a27c3743150382678109c160c349cef81f5881880d5fd15d85f3131
-
SSDEEP
1536:n6kcl0aNe8/ob4QjhAhTJ8yZfjL45t+OTw47ho9rCX7CesAKsGCnINYZhh56ubP7:6kclLNsSTbJG+gw47K9rCX7CessGyICJ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3244 msedge.exe 3244 msedge.exe 3840 msedge.exe 3840 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3840 msedge.exe 3840 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3840 wrote to memory of 2656 3840 msedge.exe 83 PID 3840 wrote to memory of 2656 3840 msedge.exe 83 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 1032 3840 msedge.exe 84 PID 3840 wrote to memory of 3244 3840 msedge.exe 85 PID 3840 wrote to memory of 3244 3840 msedge.exe 85 PID 3840 wrote to memory of 2420 3840 msedge.exe 86 PID 3840 wrote to memory of 2420 3840 msedge.exe 86 PID 3840 wrote to memory of 2420 3840 msedge.exe 86 PID 3840 wrote to memory of 2420 3840 msedge.exe 86 PID 3840 wrote to memory of 2420 3840 msedge.exe 86 PID 3840 wrote to memory of 2420 3840 msedge.exe 86 PID 3840 wrote to memory of 2420 3840 msedge.exe 86 PID 3840 wrote to memory of 2420 3840 msedge.exe 86 PID 3840 wrote to memory of 2420 3840 msedge.exe 86 PID 3840 wrote to memory of 2420 3840 msedge.exe 86 PID 3840 wrote to memory of 2420 3840 msedge.exe 86 PID 3840 wrote to memory of 2420 3840 msedge.exe 86 PID 3840 wrote to memory of 2420 3840 msedge.exe 86 PID 3840 wrote to memory of 2420 3840 msedge.exe 86 PID 3840 wrote to memory of 2420 3840 msedge.exe 86 PID 3840 wrote to memory of 2420 3840 msedge.exe 86 PID 3840 wrote to memory of 2420 3840 msedge.exe 86 PID 3840 wrote to memory of 2420 3840 msedge.exe 86 PID 3840 wrote to memory of 2420 3840 msedge.exe 86 PID 3840 wrote to memory of 2420 3840 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9108047639ffd2b1cf51b7055e7f966d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c0ef46f8,0x7ff8c0ef4708,0x7ff8c0ef47182⤵PID:2656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,309514644049099653,13494833247441547752,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:1032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,309514644049099653,13494833247441547752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,309514644049099653,13494833247441547752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:82⤵PID:2420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,309514644049099653,13494833247441547752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:1780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,309514644049099653,13494833247441547752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:3584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,309514644049099653,13494833247441547752,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3120 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4688
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4348
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5884c77a4366a0f532c141cbe1233f6f9
SHA109bb7d9d56b8fa009f1a1e0540479c48c6bfb193
SHA2561552b735d8f3c8ad697b7bab3756af7c3e34ad322524b04e250aa6320c2d2bf4
SHA512d68f89a07eed1dbd49e98788a9807a3f4beda8539738ecd3254dbc1a47df5d4c2bac440237feddd32f29efc795bf93be0cc27b6bbf37453b018ffe5afc27b86a
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
1KB
MD50435a67ae41fb62104824a4c8b88c0f9
SHA138e2ad04be495c4cc48e3340d4e38b459c2148fa
SHA256acc206e1899d52664ecd3ead42ed00150063ccccbcef62d89ef0aa28f6a0a86f
SHA5120355c683f46dc8f77a6f9be3232e6dcbaa61ab2aa51bb710e6d021905f0eb5917ac3e17308efc80d6a2576548836d0597b405894b3c7da6d9b3051c611d39c33
-
Filesize
5KB
MD500a386242c955b58f786733e93d955f5
SHA1ba62f8218d3e5b78862fb1a9e286d5ffa4ab617c
SHA256c014b3d7e158420caba1fa20e2493e3735b8f2a1861f2d1a30ff3e11b9d6410c
SHA512400157f1a279500ec0e4879d23bc61d937054c2539d5ba9f33805d3e009a5cb0fac4d577b37a1769ece5664f77371e0bf89bc21f87bbecf993707f8dc93ed092
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\da5dad5b-5be3-4fb7-bc99-fca080fa5ef2.tmp
Filesize6KB
MD52a4bf2d9bd231bffb2d85bd1b70b0e68
SHA10eff0a3fbf9d0269cec71cc86892561c578c07eb
SHA25674cd076e474d074340cf1ada1f0d242cdc0b975fc9f8767d0fdf434ff0efffbe
SHA512fea722a8df0493d3bdff2400adf2f4142248f25b3c39caad1a8fe6411495ac0a7cf921d5c511edbbe5731941293096d2f02605e8f8d5695ae809babbba90eaad