Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 12:56
Static task
static1
Behavioral task
behavioral1
Sample
91dd698a60e24fe8eabc02a6a36557a7_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
91dd698a60e24fe8eabc02a6a36557a7_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
91dd698a60e24fe8eabc02a6a36557a7_JaffaCakes118.html
-
Size
170KB
-
MD5
91dd698a60e24fe8eabc02a6a36557a7
-
SHA1
5c58b3657bbe91112d5841dc71a401c9856334ca
-
SHA256
e82ece11caf0859ec19df7ff64b9cf8c380b38babc49b80c2241e911af348af3
-
SHA512
f75db89d3e2de12123c9e93087c0a55d5eba7b88dd9e6a2d4371b17b28887019ad1676d18d1ca6eb180788dce847901ac12c7cf6b65307c1c95d9a04d089e019
-
SSDEEP
3072:GTyhCAY7bmXkahQuW2vTHZz/bkmM4EKyuPEdfRPT4KhZtwFtiWXiBOLC06TvHVxx:EyhCAY7iXkahQuW2vTHZz/bkmgLeEMKt
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4896 msedge.exe 4896 msedge.exe 2940 msedge.exe 2940 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2940 msedge.exe 2940 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe 2940 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2940 wrote to memory of 1868 2940 msedge.exe 81 PID 2940 wrote to memory of 1868 2940 msedge.exe 81 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4124 2940 msedge.exe 82 PID 2940 wrote to memory of 4896 2940 msedge.exe 83 PID 2940 wrote to memory of 4896 2940 msedge.exe 83 PID 2940 wrote to memory of 3000 2940 msedge.exe 84 PID 2940 wrote to memory of 3000 2940 msedge.exe 84 PID 2940 wrote to memory of 3000 2940 msedge.exe 84 PID 2940 wrote to memory of 3000 2940 msedge.exe 84 PID 2940 wrote to memory of 3000 2940 msedge.exe 84 PID 2940 wrote to memory of 3000 2940 msedge.exe 84 PID 2940 wrote to memory of 3000 2940 msedge.exe 84 PID 2940 wrote to memory of 3000 2940 msedge.exe 84 PID 2940 wrote to memory of 3000 2940 msedge.exe 84 PID 2940 wrote to memory of 3000 2940 msedge.exe 84 PID 2940 wrote to memory of 3000 2940 msedge.exe 84 PID 2940 wrote to memory of 3000 2940 msedge.exe 84 PID 2940 wrote to memory of 3000 2940 msedge.exe 84 PID 2940 wrote to memory of 3000 2940 msedge.exe 84 PID 2940 wrote to memory of 3000 2940 msedge.exe 84 PID 2940 wrote to memory of 3000 2940 msedge.exe 84 PID 2940 wrote to memory of 3000 2940 msedge.exe 84 PID 2940 wrote to memory of 3000 2940 msedge.exe 84 PID 2940 wrote to memory of 3000 2940 msedge.exe 84 PID 2940 wrote to memory of 3000 2940 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91dd698a60e24fe8eabc02a6a36557a7_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6f0146f8,0x7ffc6f014708,0x7ffc6f0147182⤵PID:1868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,13323424106690795034,622878702904794077,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:4124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,13323424106690795034,622878702904794077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,13323424106690795034,622878702904794077,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:3000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13323424106690795034,622878702904794077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:1988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13323424106690795034,622878702904794077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,13323424106690795034,622878702904794077,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4920 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3376
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2116
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1140
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
1KB
MD5d7430b7499be25ee45fb672ef01389de
SHA1c432218973e368848e3696c386008b0f650c2763
SHA2565e29aff21413b3a91dac90cd3e40738ac23beb65ad75c8a194d6f1755447d14c
SHA512568c0d9a910ba7f8f1687ff84fbb97ca9d8a8f1b72e531b978b44df6ca040f641861ed9d4c315b5bf87df5b68b9d66bd39471b43513e256316dc16804663e182
-
Filesize
5KB
MD53c4fdaf7e56b5e5ba55a586fbfbde854
SHA159b828158ab9e2b80da1e3bd50d577d0a154d977
SHA25615ff57af47a186d084b177c37fbad69c825117249b385a3a60f0c978467d0883
SHA512d33435f87a80b2d3a03598a9aeb1c32792386e68f55b58b69deca042c51abeab647fbfe7530c14bae5f5761066cc094827e09273845a85c37e75f1dfabbd70ac
-
Filesize
6KB
MD53e9dc0e7ecb834de5d44ed815807cf88
SHA1a29689997ae8f80a6d146625b996ec8b9ffe9758
SHA25642c52003b32b7d08c4a478db53d9124d5b908a3e684ad245d8b551373d27ee4c
SHA5124b995d36f2e416849fbf514d1e9c56cba0ecc5e5fa5df0175a8c6c835b87d7c5f0a057e107c2cb2842b88bf2f98c7015bf19ee95407ffbe96f203436cb82b38c
-
Filesize
6KB
MD54000863dffe29fa9ccaaa07fee1d082c
SHA19fa9da888193180eff539310c4e156373971ecac
SHA256157db93c4bd7543183e0e3dce7ba84b55eb53ab753056c1eac026d7d098b550b
SHA512746ad8a06d6668cc64437ef2c889253e86902dc0f80ded808f4f15d084471d7e61ed6dc7991a0c18ea3e4028ba7399d8a43028f66821d73f1cb402d73fca4079
-
Filesize
706B
MD5cff9505d7921d97ce1d8227faba06193
SHA1352def65a6640a7921f693b8c74f7efcd9d8da8d
SHA25683b4e645ee535e4106937ee342589fa9c4b9a98562ce0f3866aee14a50b9d0d7
SHA512d293c30b67cfe5cc9e1ac453a2c5b73877cfcf32cb9b4c892e95c4fb35caf8f53c89f7e32aa58af6b6938dadc47c5c5dcecafc835ec5c6b79b22588651f499ff
-
Filesize
873B
MD59aa0972467053d96257f11d38b940e20
SHA14e118e325cd3e8f1a8f680c74960e0d94c93b73a
SHA2567b6770ca52d9dff706b313bda9339409f27794200c0f1e5cc5d5548731b88b35
SHA5121772da8a5752ebefee709be102af1d2e7e175aba3c45b32275387638aaf6e0bf62bb454cf0490dea079f69316c56b7e479d6502ffb737791b54e5b79b3145296
-
Filesize
706B
MD5fb555cb0aa7af676441d7d8526681638
SHA1ce91826579e2370de585534e8e30b98f642c8dd4
SHA256c4906e99416e62751f4990a2f549dc2f567b49d719b925534546100b231dd4fd
SHA512ec3cdcdbc39d816cc2d87c2f076b99329cf4a441ee293bb1b23a833029876aed37e3368141a0cc0a8a975886b7ed832eec53e4679797adc9a1035e97d820f9d1
-
Filesize
11KB
MD5f60ae7f505046f554f3985e4e59457e1
SHA188b457c3515942d3eed12ae89ed3041b040fecf7
SHA2560cb3757b90235b9bf5d2b8d8f1226d95744dac3e8d57b6a6aa1ac17b9226202f
SHA512cc56ad61abb6b1b7b006a6017fcd5988b8257bae5580cea2555aff8764dadc5b0b868438df86cdbf3a73c56ca81eaeb058af75f53afa5d6e46b246b231a8c1d4