Analysis
-
max time kernel
149s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 12:42
Static task
static1
Behavioral task
behavioral1
Sample
91d2f91c88fbe0c45c8b36d7ea9c6b63_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
91d2f91c88fbe0c45c8b36d7ea9c6b63_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
91d2f91c88fbe0c45c8b36d7ea9c6b63_JaffaCakes118.html
-
Size
133KB
-
MD5
91d2f91c88fbe0c45c8b36d7ea9c6b63
-
SHA1
295c7636dd50b52482fe2c4050449dc28ce7a9d3
-
SHA256
5a98ab3eabf8d337ad3682eeff50d646a95fbd552f6906cc73affafd9acc8a85
-
SHA512
3afc1cb3da4cd0fd411aad25483a028e4bc61415786de90c0894187ac3b287fa9f37ab940819894d8a3dcf51a3af746abb7a82499205fe0aab262a233a18453e
-
SSDEEP
3072:MKFtoXoOCiWG8dOMrhLJ/PYF9ylobwE9Q10gpXzt7RVk/Lo71xH+Dve+CnHj:+8vrhLJ/PYF9ylobwE9Q10gpXzt7RVkS
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4736 msedge.exe 4736 msedge.exe 1036 msedge.exe 1036 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 1828 identity_helper.exe 1828 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1036 wrote to memory of 4348 1036 msedge.exe 83 PID 1036 wrote to memory of 4348 1036 msedge.exe 83 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 1444 1036 msedge.exe 84 PID 1036 wrote to memory of 4736 1036 msedge.exe 85 PID 1036 wrote to memory of 4736 1036 msedge.exe 85 PID 1036 wrote to memory of 1152 1036 msedge.exe 86 PID 1036 wrote to memory of 1152 1036 msedge.exe 86 PID 1036 wrote to memory of 1152 1036 msedge.exe 86 PID 1036 wrote to memory of 1152 1036 msedge.exe 86 PID 1036 wrote to memory of 1152 1036 msedge.exe 86 PID 1036 wrote to memory of 1152 1036 msedge.exe 86 PID 1036 wrote to memory of 1152 1036 msedge.exe 86 PID 1036 wrote to memory of 1152 1036 msedge.exe 86 PID 1036 wrote to memory of 1152 1036 msedge.exe 86 PID 1036 wrote to memory of 1152 1036 msedge.exe 86 PID 1036 wrote to memory of 1152 1036 msedge.exe 86 PID 1036 wrote to memory of 1152 1036 msedge.exe 86 PID 1036 wrote to memory of 1152 1036 msedge.exe 86 PID 1036 wrote to memory of 1152 1036 msedge.exe 86 PID 1036 wrote to memory of 1152 1036 msedge.exe 86 PID 1036 wrote to memory of 1152 1036 msedge.exe 86 PID 1036 wrote to memory of 1152 1036 msedge.exe 86 PID 1036 wrote to memory of 1152 1036 msedge.exe 86 PID 1036 wrote to memory of 1152 1036 msedge.exe 86 PID 1036 wrote to memory of 1152 1036 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91d2f91c88fbe0c45c8b36d7ea9c6b63_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e7e446f8,0x7ff8e7e44708,0x7ff8e7e447182⤵PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,2276202806030253808,1422671902827767786,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,2276202806030253808,1422671902827767786,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,2276202806030253808,1422671902827767786,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵PID:1152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,2276202806030253808,1422671902827767786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:3316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,2276202806030253808,1422671902827767786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:3140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,2276202806030253808,1422671902827767786,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,2276202806030253808,1422671902827767786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:12⤵PID:2324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,2276202806030253808,1422671902827767786,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:12⤵PID:348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,2276202806030253808,1422671902827767786,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:82⤵PID:3260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,2276202806030253808,1422671902827767786,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,2276202806030253808,1422671902827767786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:12⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,2276202806030253808,1422671902827767786,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:12⤵PID:5080
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3204
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
Filesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
273B
MD5e01d705b628f3d2cd5cd2ac335ce5cd0
SHA1054de3168baf8c4507d7a471c65806188dc4bbfa
SHA256e741e8d77febb982933635c3fa89a442fa247b308fdc7b80c1ce6220ee0d0e01
SHA5126602350fb564b5379408a23062d7b73888d907d6b8d399df18ee93dc3a6c37c7c405bc62bdc932d1971ae21a481b4ddc204a4b60290fbec8f1662487ab073bcd
-
Filesize
5KB
MD5ba2f6c70abc00c8fb39065caa1a66339
SHA1c7c230351733a3b24371ab05735a3c59660fe0e9
SHA2563d85575e040ffabdd84673ec0ec944d67b7de4dd96e6a02f961dd0de5ac7fd46
SHA512938d1a6e0b8308f5457f5c4f1fd6d0fe2691d4c5f83dc48504a6a9d6479ed3e06c708011be93d32427922f00f33d2d0af4b0e2ce8c18228599034114b02100f8
-
Filesize
6KB
MD59a5ec578de906b30403565f377797805
SHA1d17773fe4701b9fdca635b7583f5bebf3df92b89
SHA25627828d9ff3bf2832931ed985ab87f332de9c855889fcd1fb24fb5d75c1bb21f2
SHA512ca36f2a531b96908a530a31cade32a28199d11322c4be41e21d70517a6375a29d8e99101b68945bcad5210c0522baed24f761a3414634d143e61ea98797a594d
-
Filesize
537B
MD52f33e13e0dfd5fb591fc30fd3254f738
SHA123ec40accbb9d21dc8cb79f62f5f5ccb129fcaf0
SHA25663519694437c630aee2964edd1b5f7886d09b7d5be1c070436811dbfa1ef1479
SHA512f40f3254e446318d39d0a0031ec1f1075f556ea1eeb19b69466b1a137d77939958ecc16c9c94d1da940b9b57fdb749c0c3d31a0d035fae50b5594d23303c6269
-
Filesize
367B
MD5abdedac0327a19eb3731e0dc2cd1c0b4
SHA19ab71d522c61c870720f9473fe24194dc86ad3cb
SHA256e874ff20133244c25e5346a26410c35c2750c16dd9a9919672ca5b3e35778a40
SHA51251b422d5c76cebc621befbf08a72a54375efc4dcf63c22fc41ec21da6e28f2a89cdc68c89212633c5310b8864ccd249df3f827b395eb084110dcd00ce5d5837f
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD558a24d63e0aa4c47760dfc508ab80dae
SHA14dde6a901830c756d2fe8f2e21d393b601daa72c
SHA256fde6a4210f6081eaadbd64fa7ed6dffc1ac993f25985ca3516fa87ae16ca1716
SHA512739d2d3e4a83a24e53d6bc72ca0fa7ac53addd58af5a9127749e059c2eddd7426a460a53b8c91b33dc55c160dd172929866a86d55d0e57eb8a68d888fc5951b2