Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 13:06
Static task
static1
Behavioral task
behavioral1
Sample
91e427dda315d008ef82281a5cf9396c_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
91e427dda315d008ef82281a5cf9396c_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
91e427dda315d008ef82281a5cf9396c_JaffaCakes118.html
-
Size
68KB
-
MD5
91e427dda315d008ef82281a5cf9396c
-
SHA1
b04ff5223d60753a629951ccb135e8812f82f755
-
SHA256
eb30bb298ee7920a1229441f171ab1668fd236eb5e4393db3336be5eff21f9ed
-
SHA512
3e85345f98ef154fc4bcdc4d6879a890c5d6ae57a6640d7407ab1f84385bc534a7638579edafe655ab463bf206d3319ea4f1053414060d20f37dd8d6e5cf6028
-
SSDEEP
768:JiUgcMiR3sI2PDDnX0g6jYHf5oTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8sM:JSZfOTcNen0tbrga94hcuNnQC
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3964 msedge.exe 3964 msedge.exe 4672 msedge.exe 4672 msedge.exe 1656 identity_helper.exe 1656 identity_helper.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe 4620 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4672 wrote to memory of 3136 4672 msedge.exe 83 PID 4672 wrote to memory of 3136 4672 msedge.exe 83 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 4540 4672 msedge.exe 84 PID 4672 wrote to memory of 3964 4672 msedge.exe 85 PID 4672 wrote to memory of 3964 4672 msedge.exe 85 PID 4672 wrote to memory of 2640 4672 msedge.exe 86 PID 4672 wrote to memory of 2640 4672 msedge.exe 86 PID 4672 wrote to memory of 2640 4672 msedge.exe 86 PID 4672 wrote to memory of 2640 4672 msedge.exe 86 PID 4672 wrote to memory of 2640 4672 msedge.exe 86 PID 4672 wrote to memory of 2640 4672 msedge.exe 86 PID 4672 wrote to memory of 2640 4672 msedge.exe 86 PID 4672 wrote to memory of 2640 4672 msedge.exe 86 PID 4672 wrote to memory of 2640 4672 msedge.exe 86 PID 4672 wrote to memory of 2640 4672 msedge.exe 86 PID 4672 wrote to memory of 2640 4672 msedge.exe 86 PID 4672 wrote to memory of 2640 4672 msedge.exe 86 PID 4672 wrote to memory of 2640 4672 msedge.exe 86 PID 4672 wrote to memory of 2640 4672 msedge.exe 86 PID 4672 wrote to memory of 2640 4672 msedge.exe 86 PID 4672 wrote to memory of 2640 4672 msedge.exe 86 PID 4672 wrote to memory of 2640 4672 msedge.exe 86 PID 4672 wrote to memory of 2640 4672 msedge.exe 86 PID 4672 wrote to memory of 2640 4672 msedge.exe 86 PID 4672 wrote to memory of 2640 4672 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91e427dda315d008ef82281a5cf9396c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab50846f8,0x7ffab5084708,0x7ffab50847182⤵PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,17005831567760741595,5978540389108173667,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:4540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,17005831567760741595,5978540389108173667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,17005831567760741595,5978540389108173667,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵PID:2640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17005831567760741595,5978540389108173667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17005831567760741595,5978540389108173667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17005831567760741595,5978540389108173667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:12⤵PID:3252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,17005831567760741595,5978540389108173667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:82⤵PID:572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,17005831567760741595,5978540389108173667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17005831567760741595,5978540389108173667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:12⤵PID:1524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17005831567760741595,5978540389108173667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:12⤵PID:1516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17005831567760741595,5978540389108173667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:12⤵PID:2404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17005831567760741595,5978540389108173667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:12⤵PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,17005831567760741595,5978540389108173667,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3068 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4620
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5716
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA2565009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
-
Filesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5f289ff0dea84aea3e191bf24da7271b1
SHA149beaf912a392df98a6fa5a8a23bc31de8e68142
SHA25645c8d75754213cbf09f954066ec8d5c88f0796e588991780e926dfb6855c7734
SHA512242ac5a49f2230ce2b6ff1efa52997294174416c0f1211d85fbe112849b14e245fcddfd7b8b7af90147193cb48636e513426cc994cffe6c30237424c358e7496
-
Filesize
408B
MD52b321b1b34acff270399ee86e34d698c
SHA1f47a32cd348ae2f8a90a27ed0c14fefc91cd2f47
SHA25627a55c1dc75f7ec01a17620aaa6dd58393170c0b576ecaf24d688e64338a4d67
SHA512f0f4bafabf51212126c49f88578c695674dbdf4bb7f20c8a86e7751ccec530b7d5354b6a3ac2036ec64ffa87363aed606bb3409f9b0515a6afc2cb98fa8e8762
-
Filesize
5KB
MD58ab8dbab7d1134948e98985e82079cd0
SHA1bdcc7757793638f6ffe3b406100b93202a89e2d4
SHA25647c1fd62d27c5b616c9542acadc13f5e2e1c7b2f18e90101d2e7ec44e68f1a72
SHA512080b8ca8c813ce004f5d1a7724ed241befd54b432d16a2bc5366d8ad55effa881a430c8412a739a2670cf55aa315acab2dfb5f4f129f2ff6fc8f35f1859ce163
-
Filesize
6KB
MD58bf5af9da6359e958f70b0c7634f2425
SHA13dfc3fd368e5a35082e7f120660d57ad2a92ee47
SHA256cfe270354c8f51c48e8a749d0c305a40fac9f12b330322303692d4d726f7f60c
SHA512b7505edcba0ed09b1396fca3aff2c05281c977dd00e0cf7bdfa89effbc401b95cd44c809141382afeb8076fb5d55cd061c0a7d8d644fc64e1d5b4554bb2522f2
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD51e305ad1df9e85d659b493a48fa0b56b
SHA11bacd1aec0a18c7fa3a9db0c848bf98193974b7a
SHA2566eec3d47148bae1758c0045e40bc51fd753d8f162ffc4522e409b1f926f2dd31
SHA512881b3a670d85813d58feb0a6d88d024d38a0ee67111f16728ff571f9c6d800c33780d39f62fd2e6c47ce5d59893975d1b95616d8d90b853576a1905f6c7d9c37