Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 10:34
Static task
static1
Behavioral task
behavioral1
Sample
9176b1450f38b24d0fa30c009d531643_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9176b1450f38b24d0fa30c009d531643_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9176b1450f38b24d0fa30c009d531643_JaffaCakes118.html
-
Size
65KB
-
MD5
9176b1450f38b24d0fa30c009d531643
-
SHA1
e829c725a3258e5be7fe1f79fdb934bdfc4a60d2
-
SHA256
25f27daf8e62211118a22e1b4cee878afca59277e5383f69c1653a0cdd4393d8
-
SHA512
ec5340e423de32d3331d54b3606e13c0a0f9b4d2a4b533ec9a5a79bfe253bb2556de997e68122cbc1465d41471cdad5c8ccef5d671ad48a2515bf3375d80f010
-
SSDEEP
768:SjTUGElKh1SgvtO58kVF9LfGj5nMsRINwE44PyNs1bz:mTTjSgvtO58kVF9LfoxMf1H
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1436 msedge.exe 1436 msedge.exe 2456 msedge.exe 2456 msedge.exe 1940 identity_helper.exe 1940 identity_helper.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe 2456 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2456 wrote to memory of 3752 2456 msedge.exe 83 PID 2456 wrote to memory of 3752 2456 msedge.exe 83 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1560 2456 msedge.exe 84 PID 2456 wrote to memory of 1436 2456 msedge.exe 85 PID 2456 wrote to memory of 1436 2456 msedge.exe 85 PID 2456 wrote to memory of 1704 2456 msedge.exe 86 PID 2456 wrote to memory of 1704 2456 msedge.exe 86 PID 2456 wrote to memory of 1704 2456 msedge.exe 86 PID 2456 wrote to memory of 1704 2456 msedge.exe 86 PID 2456 wrote to memory of 1704 2456 msedge.exe 86 PID 2456 wrote to memory of 1704 2456 msedge.exe 86 PID 2456 wrote to memory of 1704 2456 msedge.exe 86 PID 2456 wrote to memory of 1704 2456 msedge.exe 86 PID 2456 wrote to memory of 1704 2456 msedge.exe 86 PID 2456 wrote to memory of 1704 2456 msedge.exe 86 PID 2456 wrote to memory of 1704 2456 msedge.exe 86 PID 2456 wrote to memory of 1704 2456 msedge.exe 86 PID 2456 wrote to memory of 1704 2456 msedge.exe 86 PID 2456 wrote to memory of 1704 2456 msedge.exe 86 PID 2456 wrote to memory of 1704 2456 msedge.exe 86 PID 2456 wrote to memory of 1704 2456 msedge.exe 86 PID 2456 wrote to memory of 1704 2456 msedge.exe 86 PID 2456 wrote to memory of 1704 2456 msedge.exe 86 PID 2456 wrote to memory of 1704 2456 msedge.exe 86 PID 2456 wrote to memory of 1704 2456 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9176b1450f38b24d0fa30c009d531643_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdb8546f8,0x7ffcdb854708,0x7ffcdb8547182⤵PID:3752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,2079862898380467240,14732443674215791869,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:1560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,2079862898380467240,14732443674215791869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,2079862898380467240,14732443674215791869,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:82⤵PID:1704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2079862898380467240,14732443674215791869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:1168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2079862898380467240,14732443674215791869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,2079862898380467240,14732443674215791869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:82⤵PID:3304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,2079862898380467240,14732443674215791869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2079862898380467240,14732443674215791869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:12⤵PID:1956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2079862898380467240,14732443674215791869,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:12⤵PID:2020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2079862898380467240,14732443674215791869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:12⤵PID:920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2079862898380467240,14732443674215791869,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:3472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,2079862898380467240,14732443674215791869,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4864 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4644
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4612
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
Filesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
Filesize
389B
MD54d98cb860133b5dab012d10da5925089
SHA16e7b34d42e49ecb9e0b4e022e8b071e674e0b5f6
SHA2564b0d3f88b33945b6b0e9e8f8d61a1c3207ed3e279e6de3a18db21127b1fcf016
SHA51268689d9686f133d055e9b5c3825362d4717863fb40e3dd0f5b71102d56961b7bbaba710f096cf72cc42932fa24aa9d3d37a1637b2dcfa5f5f1cb6fc0b254da86
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD59baf95a191ec31f9e7aaa84c67871f81
SHA1e32da78cdc6cb642cd914792e9fdfd5cdfb9c4b4
SHA256b68682f50f67d65c59813080aac26986b63cd3439f631a953be272e73ec37e58
SHA512001242bd66600ced78d33085639b139a0e98df4334850201f4a1d39f0b8140adc4b62abe29a69807682d187378fecd2166c072b0f24d8f4de78f3ab479ac90df
-
Filesize
6KB
MD5222fd6a63753ed3df2e6cc5ee3ff5857
SHA1b2a8dc692f37bb20c4cc28b959278ed10bcbb918
SHA256570f8c06df68985c3826da970fbda91a4bf1039fc9b7eb58931607280dbd7ddf
SHA512158b1994ce2685430df279b7840f4eb0a5da858dba0fff54323294176e8543181ba6f57412743139761c02d8220c7d0b8ee4c744ddf81449dee46e1d48a60b89
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5cbae44f37fdb13d9e6642928baec1706
SHA1a72374c113f4ca70f7b81156936411087a1d0e39
SHA256c5098dc864e57ac6ccf5b0790f8a58f7af7ad9534563991bb0ff63c817fb363c
SHA51272c322d10907eec4cdf95461b2876b56f5d28af6762495fd98602a96da2830bbdd50387e3d0c337f2a1dbf66340f8c64dc19dbbe942b841fc46dcddedc4a6ecb