Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 09:09
Static task
static1
Behavioral task
behavioral1
Sample
913bff4c78e9b149c6391d7f9d98c90c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
913bff4c78e9b149c6391d7f9d98c90c_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
913bff4c78e9b149c6391d7f9d98c90c_JaffaCakes118.html
-
Size
184KB
-
MD5
913bff4c78e9b149c6391d7f9d98c90c
-
SHA1
fa156aad16cb1767078cb9af6f532098d43ca6ab
-
SHA256
53666aaf128c481dac4051ee42a02e2021b26d9b41430d72a5f41809aed24582
-
SHA512
8ce8b7fb3dbd5c099e6f292a4bcf4f532983b320c54a467e13895924d949d766de3fdeb0755d3cd980d51699ece238fd739dacf603f2ea3a222a3b3529a39806
-
SSDEEP
3072:ZoXyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFis:tsMYod+X3oI+Yn86/U9jFis
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exemsedge.exepid process 3116 msedge.exe 3116 msedge.exe 1452 msedge.exe 1452 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
msedge.exepid process 1452 msedge.exe 1452 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1452 wrote to memory of 4852 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 4852 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3048 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3116 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 3116 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe PID 1452 wrote to memory of 396 1452 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\913bff4c78e9b149c6391d7f9d98c90c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbac2346f8,0x7ffbac234708,0x7ffbac2347182⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,13382114150881659212,9481179357973158376,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:22⤵PID:3048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,13382114150881659212,9481179357973158376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,13382114150881659212,9481179357973158376,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,13382114150881659212,9481179357973158376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:4100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,13382114150881659212,9481179357973158376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:2412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,13382114150881659212,9481179357973158376,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1896 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4480
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1480
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA2565009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
-
Filesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
Filesize
5KB
MD5596b67093066e52dbfe461daa9dc4652
SHA10f9212a65ae03074c685967b2c448a598949ec24
SHA2567eaacd56a6f0260965098db12a1d800fe42be56671d8de8f5736f6d0696619ec
SHA512d427066931b55dc582a2053237223afac91e741f11c39ca100db86f656a1729905be7501f5ca196e1d3f3c61a5b4d2cf18b0ffc2ac3a2142db47df3c4ffb155e
-
Filesize
6KB
MD5a42a6879daebefa060fd19347240bcfa
SHA183bb2f9ed254ecdba3202bb0ae6b86bc70a9939b
SHA256026b1a1af8579e239438d7b320884ef19ee92c0cd87f25c35ffb1a017f4ec818
SHA51227983a2578c6e9bfdd51a4387e2873ed05fb34743a3889d859b2c438fada69d7ba948e4169db82ddc18d66ed939da7d3d8e6530fe7c500031a1a56fb7f97a455
-
Filesize
10KB
MD52e41fbf9e874d9836e54ff8ea3e0d43f
SHA16b3f97523aac99dfb0d0b58bb94bef160b3bb67f
SHA25685bf00261500f6fd3057a2aa8432560ef371057cda234aad4e46424ca2a141fb
SHA51253c382118f9c20922d196b1361e002db77e1918d28f54360d4e288920d1126ecd0c28a88294c122142761cd7e1ed0600edeb69439ff02f594444ce4e42488805
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e