Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 08:52
Static task
static1
Behavioral task
behavioral1
Sample
912f432b337ede7f36fd3098512cd87c_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
912f432b337ede7f36fd3098512cd87c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
912f432b337ede7f36fd3098512cd87c_JaffaCakes118.html
-
Size
19KB
-
MD5
912f432b337ede7f36fd3098512cd87c
-
SHA1
1c74681b9fc6baf1dfd480d7f46588b3e0b6c7a0
-
SHA256
4f05519ee81afad83a168dbe0f01d21ccd41ec1c1eb1e4e98c40c3906664d2b9
-
SHA512
ece3310aa71a9eb3fa4232907e34f7722aca9bcf74810562abe1e8678fb1ab6f222483da200035f5716be690210e388113f3d4a08e617690c1829e1dc10c744f
-
SSDEEP
384:1Gk6MSUUK+o9iDoD6gxlIPEWoeecHkuTgkbBMxAIxiUWfDRqt4e+7PJHgARPR+R9:LLSUUK+ow0D6gxlIMWoeTHkKgkbCCaOS
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4368 msedge.exe 4368 msedge.exe 1892 msedge.exe 1892 msedge.exe 4496 identity_helper.exe 4496 identity_helper.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1892 wrote to memory of 4564 1892 msedge.exe 83 PID 1892 wrote to memory of 4564 1892 msedge.exe 83 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4348 1892 msedge.exe 84 PID 1892 wrote to memory of 4368 1892 msedge.exe 85 PID 1892 wrote to memory of 4368 1892 msedge.exe 85 PID 1892 wrote to memory of 3156 1892 msedge.exe 86 PID 1892 wrote to memory of 3156 1892 msedge.exe 86 PID 1892 wrote to memory of 3156 1892 msedge.exe 86 PID 1892 wrote to memory of 3156 1892 msedge.exe 86 PID 1892 wrote to memory of 3156 1892 msedge.exe 86 PID 1892 wrote to memory of 3156 1892 msedge.exe 86 PID 1892 wrote to memory of 3156 1892 msedge.exe 86 PID 1892 wrote to memory of 3156 1892 msedge.exe 86 PID 1892 wrote to memory of 3156 1892 msedge.exe 86 PID 1892 wrote to memory of 3156 1892 msedge.exe 86 PID 1892 wrote to memory of 3156 1892 msedge.exe 86 PID 1892 wrote to memory of 3156 1892 msedge.exe 86 PID 1892 wrote to memory of 3156 1892 msedge.exe 86 PID 1892 wrote to memory of 3156 1892 msedge.exe 86 PID 1892 wrote to memory of 3156 1892 msedge.exe 86 PID 1892 wrote to memory of 3156 1892 msedge.exe 86 PID 1892 wrote to memory of 3156 1892 msedge.exe 86 PID 1892 wrote to memory of 3156 1892 msedge.exe 86 PID 1892 wrote to memory of 3156 1892 msedge.exe 86 PID 1892 wrote to memory of 3156 1892 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\912f432b337ede7f36fd3098512cd87c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc2ac46f8,0x7ffdc2ac4708,0x7ffdc2ac47182⤵PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,11489028470688436743,5378428401980592594,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:22⤵PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,11489028470688436743,5378428401980592594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,11489028470688436743,5378428401980592594,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:82⤵PID:3156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11489028470688436743,5378428401980592594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11489028470688436743,5378428401980592594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:1000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,11489028470688436743,5378428401980592594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:82⤵PID:3724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,11489028470688436743,5378428401980592594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11489028470688436743,5378428401980592594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:12⤵PID:4324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11489028470688436743,5378428401980592594,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:12⤵PID:1228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11489028470688436743,5378428401980592594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:12⤵PID:4296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,11489028470688436743,5378428401980592594,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:12⤵PID:3308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,11489028470688436743,5378428401980592594,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4924
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3928
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\124183fa-363d-44df-b91a-dfe2530ce363.tmp
Filesize5KB
MD5e7a36e16f0bf91c16732a35083bb5bda
SHA131f089f1bd853e1739d79c6d5d102e37177a8f51
SHA256820db219cade28cc706d88ab829c6f6eca28b166c0f88a8c5d5e159eaeb4bd09
SHA512b2daf5bc999ba78e56e5900f227a8a6ca95216d555dd795a040cb1376608c6b393f4cc4d1fa6b2c3480542dac0bdaad5be928566e87bcbdd46d786e51de87e8f
-
Filesize
313B
MD5558e131a8ff795f35af48b19f9ca5c9e
SHA1dfe7767ed037e253fb9f045e6ce5bdd772080bae
SHA256a3578fa05c99ec9d6c95fca3c97b382728eb33886b794d1d0ce896b360508a3a
SHA51221943960aa3e77a3a44dd6fa6b186d6b0b0ec99504dcd97556f80a9dab45cffd03b6b80598163067852a6ad56f50e135942c8223f8a37523ac959f0519a671b3
-
Filesize
6KB
MD52ab367a25183ee9f43065fe93e01928f
SHA1dec44492cf64b63737b8286f62e36196e70980f2
SHA25683d23b775c6ee44abbf82bdbca6f62ead4f28c6c3562b6691d9e66ac263e5f5a
SHA51284f8edf4f15bcf279325965ef7177c6d9e443a6a2d5ee6104c1ce1ef0950677fcff463517c07000c8ec4524682dff4fa2882d11bc8ff72a8e76cd335fbd1b724
-
Filesize
6KB
MD589174a1514cf70830ce61180b83f72db
SHA1512362f0fff83efd2d7de7154a95b132051784af
SHA2569df74c7052335362273443c673d7153a9cc30192b519e93b837a94d716aec5d6
SHA5124935ec634f67b646074d649d9da14ef875f4cc6c2649702b446961a7530361d3ba4a15e3cbc76c7115cba5f57a7b02ebebf77eb839ed8ca65af1a972bcc26f49
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5d298b4e73326fe182a11e93d710bd8d5
SHA134ac09cdeeef96df4e05aa14fa1ae5c0d4441d8f
SHA256fc05006ba710f8f7bd80dbb421e1c246484bfe7b3bc3db1dd20220c341d283dc
SHA5124f4180233561ebbe86683415e1a961298e381e3d442052a93cbc4d57c0e3ba3eb33e582562906d08d8dc192d58bfecf45ebc4db13243b3f47354693f72e433e4