Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 08:00
Static task
static1
Behavioral task
behavioral1
Sample
9109ab817464adc123f1e64c52aef5f0_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9109ab817464adc123f1e64c52aef5f0_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
9109ab817464adc123f1e64c52aef5f0_JaffaCakes118.html
-
Size
29KB
-
MD5
9109ab817464adc123f1e64c52aef5f0
-
SHA1
a5a277634a9aa5dbe742b8c6048980e5bccf727b
-
SHA256
5575822537f60e8b037b7debbb22f20de98a12fe2171e729107315c3597290a1
-
SHA512
2f39d4e3f627786ac60e38131fbc84d8e29e36544c8565e3c0f466cffd5db1e6cc142ea13c60937430795324f9158b6740686d129ea337cf4ed58d7056a0e7f1
-
SSDEEP
384:S2hP9qOMp1O+ZQpSuMUM00IEn4iXbOpWVsmY8Avh+YpZ0ccic8qMp8A/WInImm06:SE0OMpjXGl70sO8Y50Zfa
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3972 msedge.exe 3972 msedge.exe 3344 msedge.exe 3344 msedge.exe 5096 identity_helper.exe 5096 identity_helper.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3344 wrote to memory of 644 3344 msedge.exe 82 PID 3344 wrote to memory of 644 3344 msedge.exe 82 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 1420 3344 msedge.exe 83 PID 3344 wrote to memory of 3972 3344 msedge.exe 84 PID 3344 wrote to memory of 3972 3344 msedge.exe 84 PID 3344 wrote to memory of 2356 3344 msedge.exe 85 PID 3344 wrote to memory of 2356 3344 msedge.exe 85 PID 3344 wrote to memory of 2356 3344 msedge.exe 85 PID 3344 wrote to memory of 2356 3344 msedge.exe 85 PID 3344 wrote to memory of 2356 3344 msedge.exe 85 PID 3344 wrote to memory of 2356 3344 msedge.exe 85 PID 3344 wrote to memory of 2356 3344 msedge.exe 85 PID 3344 wrote to memory of 2356 3344 msedge.exe 85 PID 3344 wrote to memory of 2356 3344 msedge.exe 85 PID 3344 wrote to memory of 2356 3344 msedge.exe 85 PID 3344 wrote to memory of 2356 3344 msedge.exe 85 PID 3344 wrote to memory of 2356 3344 msedge.exe 85 PID 3344 wrote to memory of 2356 3344 msedge.exe 85 PID 3344 wrote to memory of 2356 3344 msedge.exe 85 PID 3344 wrote to memory of 2356 3344 msedge.exe 85 PID 3344 wrote to memory of 2356 3344 msedge.exe 85 PID 3344 wrote to memory of 2356 3344 msedge.exe 85 PID 3344 wrote to memory of 2356 3344 msedge.exe 85 PID 3344 wrote to memory of 2356 3344 msedge.exe 85 PID 3344 wrote to memory of 2356 3344 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9109ab817464adc123f1e64c52aef5f0_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff2ca46f8,0x7ffff2ca4708,0x7ffff2ca47182⤵PID:644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1222325469222149129,6532121008826315915,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:1420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,1222325469222149129,6532121008826315915,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,1222325469222149129,6532121008826315915,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:2356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1222325469222149129,6532121008826315915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1222325469222149129,6532121008826315915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1222325469222149129,6532121008826315915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:12⤵PID:2160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1222325469222149129,6532121008826315915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:12⤵PID:4480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1222325469222149129,6532121008826315915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:12⤵PID:4236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1222325469222149129,6532121008826315915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:12⤵PID:1860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1222325469222149129,6532121008826315915,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:12⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1222325469222149129,6532121008826315915,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6208 /prefetch:82⤵PID:4492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1222325469222149129,6532121008826315915,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6208 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1222325469222149129,6532121008826315915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:12⤵PID:2680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1222325469222149129,6532121008826315915,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:12⤵PID:2000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1222325469222149129,6532121008826315915,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3104 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3568
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2756
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1328
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
Filesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\17cea61d-df56-4bcd-be40-d88ac0be370d.tmp
Filesize6KB
MD5f979e9911b602ee7d434fd57e5b3e429
SHA13e9978d4f6171c4eb826d4adfa964a989782996f
SHA25643cfa1439163b76602590ea37359c5e6ccc94dc5a67b7be9dc3a72beef76702f
SHA5126a16bebe926c4281830dd32534cce4335fbe71b7e96fffaf3060a9af4abbf9afeff4d0d3d2d52bb2a65f7d460fb763f7e6645edc6e0f33b10602a7fe3341ccb5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD592ac659974a0cd7a4bff3a83756b3489
SHA1993df5ca63e6fc46ee6d1f8208c3956a6e83f3c3
SHA256e25807a6ad85a7469f391a5c44addaaad34923cc50ca89bc84715b1e8e403999
SHA512a81ba262fea00562a084f7333f18601ac962b2b7e32c4ac89de8dd2050664083c3c33dd49d6d5b467d8db79301b80bf3f1caf0a4cb5591e48b73292c4b35cb8f
-
Filesize
1KB
MD50a10225c23db5358c06331d2c51fdcdd
SHA179eb77517488eb179286b8ea4779938b2322b839
SHA25616fbe8438bcec43c6102d031480027d43233727a6cf95ef1d150f37537282910
SHA51244e0512d0b2313225b236ecf9f55e493636a5bbb6fabef24d864c999092aee4a64f9f51db625aa887920db79be685f98d66d403a57cf126c56e367a3caa8ac99
-
Filesize
5KB
MD5d873391e83997dc59deb9330f1d5649f
SHA155789b574fde1d4edba1d6b7601800e644fbcce7
SHA256eca5e819e498f61994fe0cad6bcadaaf2f37a8f18f66a927ff820ff71cd4856d
SHA5126a9555c0e97024be8fa8bcb20219500800052cc79b9dcf0bb7e7d84266c91b745a64ada46ada213cd6a0c269d424d2e83b038cd953ff75c2d4fd21316aaf0a08
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5f61b11f1ecafa1fe95f842ad99de8a60
SHA10a556272b88bb6c292c1fd8e607f569cf45a5d18
SHA256c0f072dc62c029c4164abd77d2dad29a4d6d3d75207d839b0cb36ea60eab06fa
SHA5127acc1f95ed51c0eda9077ee76affcaa3032a2173308dccdbdd03697b7da4bd80f384b405bfa780f9e69cef2b7e670d6fe068d4ca17b4b5f35ddcfd1c731f846f