Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 08:00
Static task
static1
Behavioral task
behavioral1
Sample
9108fbe77a799923283ee4059b382117_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9108fbe77a799923283ee4059b382117_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
9108fbe77a799923283ee4059b382117_JaffaCakes118.html
-
Size
46KB
-
MD5
9108fbe77a799923283ee4059b382117
-
SHA1
0f4df5aa0d673b5059fb473a4f784f6d81df5e58
-
SHA256
caa1c54d1fe99c6e487a05abf4433e716677d2e1a1a489e86f28301e409369f6
-
SHA512
74f908358635202f7a60cc98ff6cd03596b5d2b5906e10ae0ef3e147d7a48c1184f0acdb56d3682863e262437bb60047638eef49e4abf7b3e729feb642f5ec45
-
SSDEEP
768:STVaRVvNw5X3vfB7B/BDCCEB2B3BWBBBaBMBRBNBdLUi9kYOH:STVaRVvNw5X33B7B/BDCCEB2B3BWBBBC
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 448 msedge.exe 448 msedge.exe 4580 msedge.exe 4580 msedge.exe 1688 identity_helper.exe 1688 identity_helper.exe 4656 msedge.exe 4656 msedge.exe 4656 msedge.exe 4656 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4580 wrote to memory of 1384 4580 msedge.exe 82 PID 4580 wrote to memory of 1384 4580 msedge.exe 82 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 3692 4580 msedge.exe 83 PID 4580 wrote to memory of 448 4580 msedge.exe 84 PID 4580 wrote to memory of 448 4580 msedge.exe 84 PID 4580 wrote to memory of 1992 4580 msedge.exe 85 PID 4580 wrote to memory of 1992 4580 msedge.exe 85 PID 4580 wrote to memory of 1992 4580 msedge.exe 85 PID 4580 wrote to memory of 1992 4580 msedge.exe 85 PID 4580 wrote to memory of 1992 4580 msedge.exe 85 PID 4580 wrote to memory of 1992 4580 msedge.exe 85 PID 4580 wrote to memory of 1992 4580 msedge.exe 85 PID 4580 wrote to memory of 1992 4580 msedge.exe 85 PID 4580 wrote to memory of 1992 4580 msedge.exe 85 PID 4580 wrote to memory of 1992 4580 msedge.exe 85 PID 4580 wrote to memory of 1992 4580 msedge.exe 85 PID 4580 wrote to memory of 1992 4580 msedge.exe 85 PID 4580 wrote to memory of 1992 4580 msedge.exe 85 PID 4580 wrote to memory of 1992 4580 msedge.exe 85 PID 4580 wrote to memory of 1992 4580 msedge.exe 85 PID 4580 wrote to memory of 1992 4580 msedge.exe 85 PID 4580 wrote to memory of 1992 4580 msedge.exe 85 PID 4580 wrote to memory of 1992 4580 msedge.exe 85 PID 4580 wrote to memory of 1992 4580 msedge.exe 85 PID 4580 wrote to memory of 1992 4580 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9108fbe77a799923283ee4059b382117_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe344246f8,0x7ffe34424708,0x7ffe344247182⤵PID:1384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,1894594256536663301,17529148887726612295,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:3692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,1894594256536663301,17529148887726612295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,1894594256536663301,17529148887726612295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:82⤵PID:1992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1894594256536663301,17529148887726612295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:4504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1894594256536663301,17529148887726612295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:1172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,1894594256536663301,17529148887726612295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:82⤵PID:368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,1894594256536663301,17529148887726612295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1894594256536663301,17529148887726612295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:12⤵PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1894594256536663301,17529148887726612295,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:12⤵PID:3324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1894594256536663301,17529148887726612295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:12⤵PID:3528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1894594256536663301,17529148887726612295,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:12⤵PID:2856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1894594256536663301,17529148887726612295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:12⤵PID:4512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1894594256536663301,17529148887726612295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1894594256536663301,17529148887726612295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:12⤵PID:2864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1894594256536663301,17529148887726612295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:12⤵PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,1894594256536663301,17529148887726612295,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4796 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4656
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:916
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5537815e7cc5c694912ac0308147852e4
SHA12ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA51263969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
-
Filesize
152B
MD58b167567021ccb1a9fdf073fa9112ef0
SHA13baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA25626764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7393fc24-dddf-45dd-b0f0-6259b83c9280.tmp
Filesize6KB
MD51b103cc1a270e1816cf93fdef06f8e64
SHA191d809b4132943913275e1b1b8bbc360b26d1142
SHA256b5d98788c37e2718cbe40c2d06fb8bfeac86291b07b43402e9c34dc800140a93
SHA512e2806ea2ba28cfb9085451d8b25244e277260b47fc26a350b886f6ad794d9f671cb15c2d00a1705e9fdf9e1be0dab05801de5fb4909ba1d46a16f9b313c413bd
-
Filesize
270B
MD53775bcd341d4faa09f2887fbb75a41ec
SHA12085bedf84e20378eacb507a678d8e78e381493e
SHA256019904e3e424579021b3a054d5021b29dac877902d9be41ab14c5a75fea35113
SHA5124e392be99c465696684fb58966cbe9bde4bc8562fc4a5fdeed36ef80c4e8fe0d34d8d049a92aa7c137ae9f0bf962add0562c20375271f6f10a4be6473d67354f
-
Filesize
5KB
MD512aa778f8344faccdf5a5d44c8e4bf9f
SHA19eea3495280e0cae5c4aad74cb9c09fc63b0b68c
SHA2565908a36480efd170b776bf7de1c5a9ef069ec465611debf1438eff3f3f408347
SHA512f11b5c95a5cfe059956d4b17e3dbb15cb441b36a9278f58805162944c0f1dbf614b38f4da8b0fd0593e727b584b34c6786151cf39a207c33192d5b89bade3378
-
Filesize
6KB
MD54cd8c3d8ded0781ad153855d1b5163b7
SHA1c8d6334433c3966a96db0b31c06868bc8b5b1475
SHA256d0ac78a0a2e74f20625556dc38420f7a3b4d80fad91cd1ccee82d6758fb4bd29
SHA5124dc37032ec0d640470f7197e775fd92a21a68889e0dc0958c828df58ef82eaa76c747cfbdc01f17fc6af1a1a9e47c4a71838221e2d771ef68fabd4c402e3e32b
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5d5cb93e9edf84ddeb032e48e48d3c2f7
SHA1995d81d5be55291fd1ebaad053772a1346c289d6
SHA25642a7858d445d6606d6b2bcfc06dbfb1f390fe804a4096242ce18384f5deea8a7
SHA512ce2c914d38b98acafa3afc98c0305a46bb43c1e08dd0ad80a0a46fe9abab22e962d9416c917f56c101d58be205e98791150627955552c4a82e4a2d8d8c49ba56