Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 08:50
Static task
static1
Behavioral task
behavioral1
Sample
912e6ae4d5a6220717a8d59c261e8a3f_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
912e6ae4d5a6220717a8d59c261e8a3f_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
912e6ae4d5a6220717a8d59c261e8a3f_JaffaCakes118.html
-
Size
36KB
-
MD5
912e6ae4d5a6220717a8d59c261e8a3f
-
SHA1
0c41d1ae0e21934d0f798666dad33fa6841d3387
-
SHA256
5bb60b55e87da4a40aaaa1acbcd9657d728b1e34bffde8febed481b8b2cd1304
-
SHA512
1e5757873ba48eb25b1a3bea05cd145413b9226e84fc2fb280533471c03d57ea05a9d217bc27337fd4d9254a791eb958815fe820442b8940b5938c5c8afd4631
-
SSDEEP
768:zwx/MDTHyU88hARiZPXlE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6ThZOg6f9U56lLRl:Q/LbJxNVNufSM/P8EK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1472 msedge.exe 1472 msedge.exe 3224 msedge.exe 3224 msedge.exe 2372 identity_helper.exe 2372 identity_helper.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe 3224 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3224 wrote to memory of 2348 3224 msedge.exe 82 PID 3224 wrote to memory of 2348 3224 msedge.exe 82 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1520 3224 msedge.exe 83 PID 3224 wrote to memory of 1472 3224 msedge.exe 84 PID 3224 wrote to memory of 1472 3224 msedge.exe 84 PID 3224 wrote to memory of 4360 3224 msedge.exe 85 PID 3224 wrote to memory of 4360 3224 msedge.exe 85 PID 3224 wrote to memory of 4360 3224 msedge.exe 85 PID 3224 wrote to memory of 4360 3224 msedge.exe 85 PID 3224 wrote to memory of 4360 3224 msedge.exe 85 PID 3224 wrote to memory of 4360 3224 msedge.exe 85 PID 3224 wrote to memory of 4360 3224 msedge.exe 85 PID 3224 wrote to memory of 4360 3224 msedge.exe 85 PID 3224 wrote to memory of 4360 3224 msedge.exe 85 PID 3224 wrote to memory of 4360 3224 msedge.exe 85 PID 3224 wrote to memory of 4360 3224 msedge.exe 85 PID 3224 wrote to memory of 4360 3224 msedge.exe 85 PID 3224 wrote to memory of 4360 3224 msedge.exe 85 PID 3224 wrote to memory of 4360 3224 msedge.exe 85 PID 3224 wrote to memory of 4360 3224 msedge.exe 85 PID 3224 wrote to memory of 4360 3224 msedge.exe 85 PID 3224 wrote to memory of 4360 3224 msedge.exe 85 PID 3224 wrote to memory of 4360 3224 msedge.exe 85 PID 3224 wrote to memory of 4360 3224 msedge.exe 85 PID 3224 wrote to memory of 4360 3224 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\912e6ae4d5a6220717a8d59c261e8a3f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff16cc46f8,0x7fff16cc4708,0x7fff16cc47182⤵PID:2348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10393521971112119723,17873498735367981762,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:1520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,10393521971112119723,17873498735367981762,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,10393521971112119723,17873498735367981762,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:82⤵PID:4360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10393521971112119723,17873498735367981762,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:4856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10393521971112119723,17873498735367981762,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:4868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10393521971112119723,17873498735367981762,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:82⤵PID:2696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10393521971112119723,17873498735367981762,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10393521971112119723,17873498735367981762,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:12⤵PID:908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10393521971112119723,17873498735367981762,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:12⤵PID:540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10393521971112119723,17873498735367981762,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:12⤵PID:1104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10393521971112119723,17873498735367981762,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:12⤵PID:3420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10393521971112119723,17873498735367981762,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1960 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:540
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5040
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
Filesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
Filesize
614B
MD52d775b23eba13edb56413d3a44db3913
SHA16571211290cbf0f9fd86e840dea70ceaf6476a4e
SHA256d3779a1e2486b9e0558ed98d78067f21ab7ebbd89985a7c5473031c0d3a5dc8f
SHA5123e90d4d3c9bd1f9a46b6f953cf459b6ddec8e1eea0f141f310cc19fe7468a3fa4792b0d184f7f1d67c0c9756bb95145f2cf2c7763e803684dd9b76b49ba5f19e
-
Filesize
5KB
MD58a55c9726702eff821a57fac2bbee3db
SHA1df833c39d21d452e4f6b42220fdc5b1d08fab885
SHA2560a134371071ba564a5f2138f01afcc29bf4bb39df2c7594cdde22496612a9652
SHA512311e8ddd598910803f7fa32d6b0879e3c0b6ba0b1d512b06b0ed7787c82226ac2fa0b318f32340da401539ecd31e2bf53716e260dbda236dc054313c92e9bfb9
-
Filesize
6KB
MD5d3c38ffb79078a4a9e85217ea78bc835
SHA1fec52c01c066f9df825c6a3777aa0b1227417468
SHA2562114e2baf5f48777956c6c85be431c3794833d2a99fe9372b28b62e7e834834b
SHA5127d9768288ed3e7e466c39510ab24e3d898e2c56b478a13a974aa788614b8e05353b953df48959bcec087c17e8555f949ccd0ca8921827f8a8e1fa1200dff1fd0
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD59206d03aa1afd26a7772529e698749d4
SHA1868ccdf5901b1880158f4818545001a8f57143cf
SHA256f58b9e05687d33286bff007f2951bd02803734a97421032620c65e9e906547f4
SHA512cc31322992a48ea41bf1747f9085fbf8491b1e7cc803f9c17064605429d4657e1f8e1b6fb7e68bfeb8a6a53125f553beaa2341534cb5d0416c90b8bff46aaa3d