Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 08:02
Static task
static1
Behavioral task
behavioral1
Sample
910b5e2f86ab6dae3968725d7782ec9b_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
910b5e2f86ab6dae3968725d7782ec9b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
910b5e2f86ab6dae3968725d7782ec9b_JaffaCakes118.html
-
Size
30KB
-
MD5
910b5e2f86ab6dae3968725d7782ec9b
-
SHA1
deb646ab4d22cf163c7ff099196c4a338b0e122c
-
SHA256
440d6a27c926138b41b412198a4837e0d6007108e16747e30f2a6f184f76eae0
-
SHA512
50054eb657bb1afa599eab47bb5910846096d900ebc7023cdbb0cdf497526288e61a01aed47e1e0430be7e39069a5946f6866613e6ff5fc9a359342402c0c69b
-
SSDEEP
768:gpajpG6OSSM2lfa8kQfqTLEmhP6bVczcA:UajuSSM2E8kQ0LEmhiA
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3124 msedge.exe 3124 msedge.exe 4488 msedge.exe 4488 msedge.exe 896 identity_helper.exe 896 identity_helper.exe 5224 msedge.exe 5224 msedge.exe 5224 msedge.exe 5224 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1492 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1492 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4488 wrote to memory of 4924 4488 msedge.exe 83 PID 4488 wrote to memory of 4924 4488 msedge.exe 83 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 2408 4488 msedge.exe 84 PID 4488 wrote to memory of 3124 4488 msedge.exe 85 PID 4488 wrote to memory of 3124 4488 msedge.exe 85 PID 4488 wrote to memory of 2648 4488 msedge.exe 86 PID 4488 wrote to memory of 2648 4488 msedge.exe 86 PID 4488 wrote to memory of 2648 4488 msedge.exe 86 PID 4488 wrote to memory of 2648 4488 msedge.exe 86 PID 4488 wrote to memory of 2648 4488 msedge.exe 86 PID 4488 wrote to memory of 2648 4488 msedge.exe 86 PID 4488 wrote to memory of 2648 4488 msedge.exe 86 PID 4488 wrote to memory of 2648 4488 msedge.exe 86 PID 4488 wrote to memory of 2648 4488 msedge.exe 86 PID 4488 wrote to memory of 2648 4488 msedge.exe 86 PID 4488 wrote to memory of 2648 4488 msedge.exe 86 PID 4488 wrote to memory of 2648 4488 msedge.exe 86 PID 4488 wrote to memory of 2648 4488 msedge.exe 86 PID 4488 wrote to memory of 2648 4488 msedge.exe 86 PID 4488 wrote to memory of 2648 4488 msedge.exe 86 PID 4488 wrote to memory of 2648 4488 msedge.exe 86 PID 4488 wrote to memory of 2648 4488 msedge.exe 86 PID 4488 wrote to memory of 2648 4488 msedge.exe 86 PID 4488 wrote to memory of 2648 4488 msedge.exe 86 PID 4488 wrote to memory of 2648 4488 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\910b5e2f86ab6dae3968725d7782ec9b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e77046f8,0x7ff8e7704708,0x7ff8e77047182⤵PID:4924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11830154412795285452,16106638074504400062,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵PID:2408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,11830154412795285452,16106638074504400062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,11830154412795285452,16106638074504400062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:82⤵PID:2648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11830154412795285452,16106638074504400062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:2676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11830154412795285452,16106638074504400062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11830154412795285452,16106638074504400062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:12⤵PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11830154412795285452,16106638074504400062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:12⤵PID:2036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11830154412795285452,16106638074504400062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:12⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,11830154412795285452,16106638074504400062,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5976 /prefetch:82⤵PID:3984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11830154412795285452,16106638074504400062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:82⤵PID:4552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11830154412795285452,16106638074504400062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11830154412795285452,16106638074504400062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:12⤵PID:3128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11830154412795285452,16106638074504400062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:12⤵PID:2352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11830154412795285452,16106638074504400062,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5224
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2776
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3836
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2d0 0x2d41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
Filesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize192B
MD593d44dd4500998e7b7cc6bd700f1be10
SHA151d2d777b352e1e196a1f045bd0fd0c844974441
SHA2563e09595708a6ce4327815a48096fcc5f73085834fa0c1a8e265bca71333670ba
SHA512e608f6746dc0018a9f4acbbd313ef73436abede722b724cdaf36725c001caecb59dde7c3c658705aafd47dac7e935ff4df1ac743d428829c1a3efa1647b10475
-
Filesize
858B
MD5e5d990f11f52bfee4edf545944635805
SHA1b168cacf2d3db7be10ba4d9c9a0a285e67be04b9
SHA256daa5dee0811da13573927ae50f4602174a3a6f2872a29b0b05ecb75e5076a37e
SHA5124f540510e9af2e3f4efb8bb67068873264231ed1a7faeb21b57a778882a8950be99e12335e473a049b80a13e05cf797f06708216a4b478211ac36777d5d0e16f
-
Filesize
5KB
MD587e392ab0f2c8d07440371562fd26b71
SHA1a618d8fe43c889d92673943fc3beb1622779403f
SHA2565e24e499b959ac7972ae4618675513f9af2c07a347b759e1cab1a3decf8b6770
SHA5126ade86b1424b83f8090d5d08f0ea6907e7c458fec686edbcc05f35b55d25d410ed93a68546d00ae8b2d5fe3eadb80c2e8ab96514fafe0fb877a09161ec5ec284
-
Filesize
6KB
MD5f354094b9066330b3d17b57e6d2a2640
SHA196ea271f9997fcf8ca6b2917f662daf9abbd30e0
SHA2563d1ec44a1bf9f76acebc9717fae77a903d32321ea4f537e35a46b4f55139c8df
SHA512aa5eeacf03f00ebabeedce2500cf48ae70a5a8502fc806b6f6c98954e5c8410ab04a9b34ab961f725c81f65a0dd7e5e758c501e014c85d268bcfdbf0708ffb00
-
Filesize
6KB
MD596d658f11c237d7e868ff14af18c1e5d
SHA1ed5b2ae0f1cfdfc729f367482566437a2c4cdc1d
SHA25664c98cb4c84ca97fd8038f1a3764a8df03db0d32e11befb19e64021f83611f11
SHA51271f7c1e5cee3a4bedfd1e6df66cb292eb192d8381c0083bb061e48974c11431b03475adf9ca4a3e909525cb0e6f2c5e84a2a074857e6ee4818ff1161a2e75418
-
Filesize
871B
MD54694cd71540f318667e53a3f53ff368b
SHA1582206ca12d46f278c061c113d6e679e4cf9c14d
SHA256c33c0fdfcf094337134dc7db9e4e47a1978c584258128b4d4d2ab201c895778b
SHA512ce4b7899fa8dc7f1ebd3931e01996bb16b800ad98aaf607dd066bffaeafa806b8c88912d53e5483fef61bdabc9528eb71b59bcb47befe5acee0ab405a87889d6
-
Filesize
871B
MD5673a2bf66b9ccabbe5922eb5217fd090
SHA11b75a2471d1a556efc9ae55b0068ecb84fbf2f30
SHA2561729d4015e02190fe6dc24269aa2e391bc701caf2ffe08cbf6041a68a9ce6af0
SHA5124051ade7ed05370218d8333b5f1ca3111e41e9aad98bca256f920d1f13096c3bbf6a9fa4fc39bcddfa897e84dd59b4efb2739e035dd0be34fefe45e59ba8ce68
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD50286ad134aca4e1c6b173da54bd54139
SHA15377ce64751f4b1e7b9988f1ca8df4b3a75c09eb
SHA256d5a9f597ef7057ec395e650054d8d24bf3261928ac8c3f7aaf9b5d9a5134b68f
SHA512c2b9b657977fdef8ef61f45ecdf16182d4153ec1ab52d66b4ba43480f4916c3f83532a7f2d4cb22dd813f27604d7e2179dcbaf21cb4933a2eeb420e56b2b2099