Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 10:40
Static task
static1
Behavioral task
behavioral1
Sample
917a22194505743b48811875fb73c986_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
917a22194505743b48811875fb73c986_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
917a22194505743b48811875fb73c986_JaffaCakes118.html
-
Size
156KB
-
MD5
917a22194505743b48811875fb73c986
-
SHA1
9f75b7d0dcc4a978bddad43b5d8a14833398619e
-
SHA256
162dea398d61235c59f100fe3b8fc99df2fafa89f41aaf111de337a58c5c25e5
-
SHA512
4f5075323740a17208d1a4ea70d56ea4d1290347fd850a085251dd61057dddb71f846a26145fcbb7813002d0eb17090b49fbfec36c574f1775be6fb94399b632
-
SSDEEP
3072:SICbVtkTC2yfkMY+BES09JXAnyrZalI+YQ:SIKVtkTCzsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4040 msedge.exe 4040 msedge.exe 4500 msedge.exe 4500 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4500 msedge.exe 4500 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4500 wrote to memory of 2308 4500 msedge.exe 82 PID 4500 wrote to memory of 2308 4500 msedge.exe 82 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 516 4500 msedge.exe 85 PID 4500 wrote to memory of 4040 4500 msedge.exe 86 PID 4500 wrote to memory of 4040 4500 msedge.exe 86 PID 4500 wrote to memory of 1404 4500 msedge.exe 87 PID 4500 wrote to memory of 1404 4500 msedge.exe 87 PID 4500 wrote to memory of 1404 4500 msedge.exe 87 PID 4500 wrote to memory of 1404 4500 msedge.exe 87 PID 4500 wrote to memory of 1404 4500 msedge.exe 87 PID 4500 wrote to memory of 1404 4500 msedge.exe 87 PID 4500 wrote to memory of 1404 4500 msedge.exe 87 PID 4500 wrote to memory of 1404 4500 msedge.exe 87 PID 4500 wrote to memory of 1404 4500 msedge.exe 87 PID 4500 wrote to memory of 1404 4500 msedge.exe 87 PID 4500 wrote to memory of 1404 4500 msedge.exe 87 PID 4500 wrote to memory of 1404 4500 msedge.exe 87 PID 4500 wrote to memory of 1404 4500 msedge.exe 87 PID 4500 wrote to memory of 1404 4500 msedge.exe 87 PID 4500 wrote to memory of 1404 4500 msedge.exe 87 PID 4500 wrote to memory of 1404 4500 msedge.exe 87 PID 4500 wrote to memory of 1404 4500 msedge.exe 87 PID 4500 wrote to memory of 1404 4500 msedge.exe 87 PID 4500 wrote to memory of 1404 4500 msedge.exe 87 PID 4500 wrote to memory of 1404 4500 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\917a22194505743b48811875fb73c986_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe8ad46f8,0x7fffe8ad4708,0x7fffe8ad47182⤵PID:2308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6800293064708908049,946852394763394670,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,6800293064708908049,946852394763394670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,6800293064708908049,946852394763394670,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:82⤵PID:1404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6800293064708908049,946852394763394670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6800293064708908049,946852394763394670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:3348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6800293064708908049,946852394763394670,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4616
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2588
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
Filesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
Filesize
6KB
MD5a80d93d693aa7f6fc190d8920949d14f
SHA1bda04ff2c7a2883be01e52e9b8dc1528b1b238bd
SHA256f63a45fb3e25da5985feb460fc1ed131afb7467e67ca6162b254931dded45b27
SHA51222901ffc6ff57328aab25ff08f874e6b82eff422f5a035e09a429b5eff451c4896d90deb161a51e714c4ba2971cae72a4e4fb12ad4f296e2d110f9d0df2e72d8
-
Filesize
5KB
MD5c0e2f2197f23af39aa56ba81d02511ef
SHA1107dec4a03582e6df475ed72e2088db1ebf75971
SHA256c98f6be39819d6c184f30753a2f8b6676b46d5683e899a15d4319b95025e3ddc
SHA5122d1be077953c38c7ea9d74b861339e38e0a76efafa388ad41e7e2f112037fa2d4284c8468d952aa1ceda6971c814b73f39a5ac349cd577a65c5c812d51e58c92
-
Filesize
10KB
MD5b41cd8d8482a4c5712d2785cf05eab85
SHA102d6c6d9a3c661d9c2a78a38af8705fdfe19c518
SHA256e02dde28756e0f3f131a31b0455a5e693ad2499d244860c9ca3faf047a7e20d6
SHA512e7f3baf63f55e33181a3b1c6b96a791e86b4ec0d72b633360376c9b29ba9cc2a461dffa167d78ebe8c57277b385197a72944e5bfe1b39e790ce96ab002cb256c