Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 12:54
Static task
static1
Behavioral task
behavioral1
Sample
91dbafb935387291419b9a4653d0dfa9_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
91dbafb935387291419b9a4653d0dfa9_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
91dbafb935387291419b9a4653d0dfa9_JaffaCakes118.html
-
Size
36KB
-
MD5
91dbafb935387291419b9a4653d0dfa9
-
SHA1
7bb63d1dcaa4775a77a2f58878fb27dab83d7197
-
SHA256
1148218578264bf8058600b1051bd89361135225156eafe936a52a682967a3d9
-
SHA512
39363d8b7c2b1b3fbee482ccd2cd9b30aa1c2a67920ab0d660918e0cf7963f11bd3c4a335162e5c5ac39e7481980c160d7f8945825c62d61d1e997548731beac
-
SSDEEP
768:zwx/MDTH4i88hARsZPXrE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6ThZOg6f9U56lLRW:Q/XbJxNVNufSM/P8vK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5004 msedge.exe 5004 msedge.exe 1168 msedge.exe 1168 msedge.exe 4640 identity_helper.exe 4640 identity_helper.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1168 wrote to memory of 2328 1168 msedge.exe 83 PID 1168 wrote to memory of 2328 1168 msedge.exe 83 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 4132 1168 msedge.exe 84 PID 1168 wrote to memory of 5004 1168 msedge.exe 85 PID 1168 wrote to memory of 5004 1168 msedge.exe 85 PID 1168 wrote to memory of 2844 1168 msedge.exe 86 PID 1168 wrote to memory of 2844 1168 msedge.exe 86 PID 1168 wrote to memory of 2844 1168 msedge.exe 86 PID 1168 wrote to memory of 2844 1168 msedge.exe 86 PID 1168 wrote to memory of 2844 1168 msedge.exe 86 PID 1168 wrote to memory of 2844 1168 msedge.exe 86 PID 1168 wrote to memory of 2844 1168 msedge.exe 86 PID 1168 wrote to memory of 2844 1168 msedge.exe 86 PID 1168 wrote to memory of 2844 1168 msedge.exe 86 PID 1168 wrote to memory of 2844 1168 msedge.exe 86 PID 1168 wrote to memory of 2844 1168 msedge.exe 86 PID 1168 wrote to memory of 2844 1168 msedge.exe 86 PID 1168 wrote to memory of 2844 1168 msedge.exe 86 PID 1168 wrote to memory of 2844 1168 msedge.exe 86 PID 1168 wrote to memory of 2844 1168 msedge.exe 86 PID 1168 wrote to memory of 2844 1168 msedge.exe 86 PID 1168 wrote to memory of 2844 1168 msedge.exe 86 PID 1168 wrote to memory of 2844 1168 msedge.exe 86 PID 1168 wrote to memory of 2844 1168 msedge.exe 86 PID 1168 wrote to memory of 2844 1168 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91dbafb935387291419b9a4653d0dfa9_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xd8,0x110,0x7ff8a47946f8,0x7ff8a4794708,0x7ff8a47947182⤵PID:2328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,4142386155655328619,16391925735699480905,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:4132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,4142386155655328619,16391925735699480905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,4142386155655328619,16391925735699480905,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:82⤵PID:2844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4142386155655328619,16391925735699480905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4142386155655328619,16391925735699480905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:2148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,4142386155655328619,16391925735699480905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:82⤵PID:4024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,4142386155655328619,16391925735699480905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4142386155655328619,16391925735699480905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:12⤵PID:4080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4142386155655328619,16391925735699480905,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2248 /prefetch:12⤵PID:4064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4142386155655328619,16391925735699480905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4142386155655328619,16391925735699480905,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:1588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,4142386155655328619,16391925735699480905,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4864 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4928
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4940
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
613B
MD539406a34bab59b981aba03e26b559186
SHA11607b7d1c1bd98af79c223792fef89a6551701a9
SHA256efe7a13e6dd09eceb0295493e9d1b38eff0f207e9638c295d7197d4fdd0652cd
SHA512df0c8f762d90032bf6cc6a582fc40c3234b0dd55dd63ecab228156a1bb70a87d92dc7408ab8cb86bc8f4a7402d1464a42d194aa70483af7498940add8a2c3ced
-
Filesize
5KB
MD5e5d45e9c2ab923464f6993df280ade1c
SHA19b088aa552fcd9e821a8094e2b43bd375c988493
SHA2562a15b822e28842cb2bcf90ec4187b13693362090f1839fe32662e4fb81fc8d3d
SHA512d978c82e76ae106f7ba1a7735c0743d79b56a2943832da55cfdf1fdfb0a4aa0059b9f6e25d0181519e0f2bcb8e11a108c23a587516fd428f065136b58e440ae6
-
Filesize
6KB
MD54ecc65339abe0ce339f5f1d69952b4c5
SHA1023b788cba5b727db565bde353e98a8e8fc6d078
SHA256dbcf8f7f750a53ed07e368bc106ad3bdd8f033f3cdd26d1ee7b18959b3aaec43
SHA512958e20764f7ab8067ddb071526903d1eabc0e2220e2ef770d0da095e40b24283321b6152a00e60f1d5df2a0e3c5e73d56a67565c308ef115cd7bdb9384c24b02
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD549bdac33630b34b3d1f23bd039fe0bcf
SHA1d3280a7cf7a33c81735a703634a0d4cf2f7f62e9
SHA2568d94869de9a108de326a848e2ebe74fc36d2a7eff370d8ed79ab04251787ff99
SHA5124dc5fbe9980bdc551775f75218717d0353ce42b8983395b2ddd9ca890a697f36dedabafc1bb4b5eb73a576cfca65e1ee5fed69da2bc03da2f4034f361b29e08d