Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 12:42
Static task
static1
Behavioral task
behavioral1
Sample
91d35a0e5c69b9a8752c49db89b23373_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
91d35a0e5c69b9a8752c49db89b23373_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
91d35a0e5c69b9a8752c49db89b23373_JaffaCakes118.html
-
Size
139KB
-
MD5
91d35a0e5c69b9a8752c49db89b23373
-
SHA1
d8e533cb71840cdfc59b7ff028c9ff3c7549af22
-
SHA256
17d34773a98612389763f9769d21bfab2d52c6d2e2d5d2d793bb8fe1e2c2be46
-
SHA512
47688c32fa00156619e7c80ae1fdb67386aad3681e441c28e1b03e1fdc7c96aae34e624b10970636f3566d91f4429ef0889218f8c62a172c7d39bf183663a824
-
SSDEEP
3072:Bk22sYJ6rHfgaToXdYK9GzNN+77nOwVZfKw9nKC5T0U9m5saK8W7OMERo:BvoaToACOw18Q5
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3588 msedge.exe 3588 msedge.exe 3476 msedge.exe 3476 msedge.exe 2324 msedge.exe 2324 msedge.exe 2324 msedge.exe 2324 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3476 msedge.exe 3476 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3476 wrote to memory of 5000 3476 msedge.exe 81 PID 3476 wrote to memory of 5000 3476 msedge.exe 81 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3460 3476 msedge.exe 82 PID 3476 wrote to memory of 3588 3476 msedge.exe 83 PID 3476 wrote to memory of 3588 3476 msedge.exe 83 PID 3476 wrote to memory of 3568 3476 msedge.exe 84 PID 3476 wrote to memory of 3568 3476 msedge.exe 84 PID 3476 wrote to memory of 3568 3476 msedge.exe 84 PID 3476 wrote to memory of 3568 3476 msedge.exe 84 PID 3476 wrote to memory of 3568 3476 msedge.exe 84 PID 3476 wrote to memory of 3568 3476 msedge.exe 84 PID 3476 wrote to memory of 3568 3476 msedge.exe 84 PID 3476 wrote to memory of 3568 3476 msedge.exe 84 PID 3476 wrote to memory of 3568 3476 msedge.exe 84 PID 3476 wrote to memory of 3568 3476 msedge.exe 84 PID 3476 wrote to memory of 3568 3476 msedge.exe 84 PID 3476 wrote to memory of 3568 3476 msedge.exe 84 PID 3476 wrote to memory of 3568 3476 msedge.exe 84 PID 3476 wrote to memory of 3568 3476 msedge.exe 84 PID 3476 wrote to memory of 3568 3476 msedge.exe 84 PID 3476 wrote to memory of 3568 3476 msedge.exe 84 PID 3476 wrote to memory of 3568 3476 msedge.exe 84 PID 3476 wrote to memory of 3568 3476 msedge.exe 84 PID 3476 wrote to memory of 3568 3476 msedge.exe 84 PID 3476 wrote to memory of 3568 3476 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91d35a0e5c69b9a8752c49db89b23373_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84b6d46f8,0x7ff84b6d4708,0x7ff84b6d47182⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,10575666240731209198,5368258092429351182,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:3460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,10575666240731209198,5368258092429351182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,10575666240731209198,5368258092429351182,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:82⤵PID:3568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10575666240731209198,5368258092429351182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10575666240731209198,5368258092429351182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:1436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,10575666240731209198,5368258092429351182,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2324
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1616
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
Filesize
703B
MD5357ccd726f0861327371e6215386a4da
SHA1150cdd753db0c0d93b662cfeef04c3002f07fd43
SHA256ae57f6eec7a5993b87722a36827fb80ac766b58b430bf4d100f6d8219ae1c239
SHA5124011a6404d6bc9ac72e3a0199c230b317a3ef2e9e7d8818aa3b8526729e9495e2a0355cee7838764622218e1e8a50798daaeae73e48cd2ca055e6243dd8b2fc9
-
Filesize
5KB
MD5f9b3690dd8f82d887096df639dadfced
SHA14c2cfe7a8e3ee8f2451806953c43bf22abdb999c
SHA256b5f9c78fe38bed3c413edd6fdb21fbab5e7f779c5e20d705b0e04b72cec439fc
SHA5129fa5c793a86750547afb47c1bc73d065c549335d9b5edef49fa8d3c34391f4b911e44042563fdaa78602f07fd563a7ffd0c84f58684e7829183c2257c83bd465
-
Filesize
6KB
MD5d7535fa056306a724b6687b5d5b4cfbe
SHA1a319c4e8a1480f147319d72305cd4d12e216b6a0
SHA256bd4b2e1e414eba1fb57d52141c71fcfe07a08038164251c774ae781023348c36
SHA51280590b4bd67c5ddbebef183108bf7dc6eaad5acdbf1bbe2d55d2f0ffa4d4ec32517aa3e4079fb053f394a0861c7928ad8f3c607e2b1951e75dbb384036b2401e
-
Filesize
10KB
MD5781e51aed7aacc071ddb49dd754e241d
SHA1a0881bd76e52d72fc89bb83c337a4d2192821c02
SHA25648c5a9a3005f0e88880c0a149973596cc1be42d0c95427092a897fb6bf9fd039
SHA5127a55d61c08dd13738c24ec2de1df6b0c2f3408a2faf8c6d7b0670244ec1fe54a1cd6ca21bdfe0a4bc577c4202188b87c0c0d15881be6a81466c272054f7c202b