Analysis
-
max time kernel
145s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 10:35
Static task
static1
Behavioral task
behavioral1
Sample
9176e8a0a1275d328b09efc7b2be2dbb_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
9176e8a0a1275d328b09efc7b2be2dbb_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
9176e8a0a1275d328b09efc7b2be2dbb_JaffaCakes118.html
-
Size
48KB
-
MD5
9176e8a0a1275d328b09efc7b2be2dbb
-
SHA1
40655621299f79cf5473a77ead849cbd329c63ea
-
SHA256
46f12d68d57635386e1f2cfc31be160544b835a42007a7796c6c7b31a8732b8f
-
SHA512
94014b135938b6971cbed2ed2154f8c5b263245d9b6e377ba1bebbb5459645a9af426b372bfc78d3f38cf05795a70f52273c34c5ce4ef979aee0839305c4ad95
-
SSDEEP
1536:N4usEGMLxjVIM9Dz3AxreyIM9DsRvq3AWQp+R2IM1DhRAyyzeWj+IM9DtRvd3ADY:3ssIM9Dz3AxreyIM9DsRvq3AWQp+R2Iy
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3996 msedge.exe 3996 msedge.exe 2696 msedge.exe 2696 msedge.exe 3612 identity_helper.exe 3612 identity_helper.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2696 wrote to memory of 3604 2696 msedge.exe 81 PID 2696 wrote to memory of 3604 2696 msedge.exe 81 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 1932 2696 msedge.exe 82 PID 2696 wrote to memory of 3996 2696 msedge.exe 83 PID 2696 wrote to memory of 3996 2696 msedge.exe 83 PID 2696 wrote to memory of 4824 2696 msedge.exe 84 PID 2696 wrote to memory of 4824 2696 msedge.exe 84 PID 2696 wrote to memory of 4824 2696 msedge.exe 84 PID 2696 wrote to memory of 4824 2696 msedge.exe 84 PID 2696 wrote to memory of 4824 2696 msedge.exe 84 PID 2696 wrote to memory of 4824 2696 msedge.exe 84 PID 2696 wrote to memory of 4824 2696 msedge.exe 84 PID 2696 wrote to memory of 4824 2696 msedge.exe 84 PID 2696 wrote to memory of 4824 2696 msedge.exe 84 PID 2696 wrote to memory of 4824 2696 msedge.exe 84 PID 2696 wrote to memory of 4824 2696 msedge.exe 84 PID 2696 wrote to memory of 4824 2696 msedge.exe 84 PID 2696 wrote to memory of 4824 2696 msedge.exe 84 PID 2696 wrote to memory of 4824 2696 msedge.exe 84 PID 2696 wrote to memory of 4824 2696 msedge.exe 84 PID 2696 wrote to memory of 4824 2696 msedge.exe 84 PID 2696 wrote to memory of 4824 2696 msedge.exe 84 PID 2696 wrote to memory of 4824 2696 msedge.exe 84 PID 2696 wrote to memory of 4824 2696 msedge.exe 84 PID 2696 wrote to memory of 4824 2696 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9176e8a0a1275d328b09efc7b2be2dbb_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9584f46f8,0x7ff9584f4708,0x7ff9584f47182⤵PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,16176811389888016072,15459619537166750743,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:1932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,16176811389888016072,15459619537166750743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,16176811389888016072,15459619537166750743,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:4824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16176811389888016072,15459619537166750743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:1748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16176811389888016072,15459619537166750743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:4432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16176811389888016072,15459619537166750743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:12⤵PID:3976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16176811389888016072,15459619537166750743,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵PID:4284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,16176811389888016072,15459619537166750743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3292 /prefetch:82⤵PID:3020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,16176811389888016072,15459619537166750743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3292 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16176811389888016072,15459619537166750743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:12⤵PID:3544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16176811389888016072,15459619537166750743,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:12⤵PID:1892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,16176811389888016072,15459619537166750743,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1376 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1352
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2984
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
Filesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
Filesize
1KB
MD5133ef66f70cbc7e0918582c84f423834
SHA1f5c553767674fcf9e47665bc6afa20d14617c658
SHA2569f0cc548ee38aa9a41348d14f236f129a2bead91adab9ae8d99d7518e25208e1
SHA51248fdf7b855665f80a2276125a4bb64c85ee80f2f50fbc555fee52f26d323d7f75b91d0e167f3591750224b812455c6b1d08897137f79c88b47615927143e1667
-
Filesize
6KB
MD5f423245fc1a4f71f83a8bd85db82bbb5
SHA18f54876aafd30b92a54342b58094a333fd8e2704
SHA2569c0ba0f96e19416239f38bf8d4ad958305c55bcd41540e7a84b523e3800dc814
SHA5124776f296d08a0cae06b0d8dc60e96effca7731448e42efaaa9481fddf9d57a321172bf7d5f8dfbdc0c15a1d53481ead4ec2ae5c49f459b2ebaf7417edc0bc88d
-
Filesize
5KB
MD5742b3b0b78dea272ad8355720090577c
SHA1bc94166c6ccd9f6ca50d1d6f4fa81b0cd3979cce
SHA25620bc18133f8cf8740f529ea78aad5a816c5e2737382ea9d78f06fbca1fa89e9f
SHA5124c32b186248a2dfbec0e9e371c4874d81fffde8c8d077fceefbf9de17e35e77f18960ee09dfd76d3b9da7aedf7bcf37c673470f816c9956fcc4b1a7188935dc8
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD513aa44d5cdd3fc2809e871fd97cc3ba9
SHA13782a2f81b4b344ad4b08d407b4acd8a67b24bee
SHA256b8729c6921dc9271e61c9234d92952c5340b0374768a80ec20879a0cf9dee201
SHA512b43df177ef375fd2a16f6d28c314babc3f287a0108882435567956a8bef6b101d5ed4e622e65231a2f73010724b9e3ca97e9e8ea54021a059d31ba0348bcd27a