Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 13:15
Static task
static1
Behavioral task
behavioral1
Sample
91ea13b928ac0f6da0f6ee7cd5204117_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
91ea13b928ac0f6da0f6ee7cd5204117_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
91ea13b928ac0f6da0f6ee7cd5204117_JaffaCakes118.html
-
Size
37KB
-
MD5
91ea13b928ac0f6da0f6ee7cd5204117
-
SHA1
e2c4bc46f5ce95db92d2093c6f5fd2a5dfa7e8c3
-
SHA256
50d62975a53a7c68ddaaa1c922bf4288a897b48d0dbf0884c4ed76cef10e83e8
-
SHA512
f9eb7dd54cd60eafbe8910c0f5df45baeeb930a810f507b41007b614c54b9e0b2a33f416cb850d1b7f15a1f4439e6ffab1f82514343cce1f62219be73f5e1ad9
-
SSDEEP
768:b/bVoRTW81D4RA+vEOjz6rdG2Gil54RZfPGnf3Gu34azi6781DdRA4vEOjq6h8at:eRTW81D4RA+vEOjz6raA7IaGC81DdRAW
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4868 msedge.exe 4868 msedge.exe 1836 msedge.exe 1836 msedge.exe 1996 identity_helper.exe 1996 identity_helper.exe 3772 msedge.exe 3772 msedge.exe 3772 msedge.exe 3772 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1836 wrote to memory of 2956 1836 msedge.exe 82 PID 1836 wrote to memory of 2956 1836 msedge.exe 82 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4492 1836 msedge.exe 83 PID 1836 wrote to memory of 4868 1836 msedge.exe 84 PID 1836 wrote to memory of 4868 1836 msedge.exe 84 PID 1836 wrote to memory of 1284 1836 msedge.exe 85 PID 1836 wrote to memory of 1284 1836 msedge.exe 85 PID 1836 wrote to memory of 1284 1836 msedge.exe 85 PID 1836 wrote to memory of 1284 1836 msedge.exe 85 PID 1836 wrote to memory of 1284 1836 msedge.exe 85 PID 1836 wrote to memory of 1284 1836 msedge.exe 85 PID 1836 wrote to memory of 1284 1836 msedge.exe 85 PID 1836 wrote to memory of 1284 1836 msedge.exe 85 PID 1836 wrote to memory of 1284 1836 msedge.exe 85 PID 1836 wrote to memory of 1284 1836 msedge.exe 85 PID 1836 wrote to memory of 1284 1836 msedge.exe 85 PID 1836 wrote to memory of 1284 1836 msedge.exe 85 PID 1836 wrote to memory of 1284 1836 msedge.exe 85 PID 1836 wrote to memory of 1284 1836 msedge.exe 85 PID 1836 wrote to memory of 1284 1836 msedge.exe 85 PID 1836 wrote to memory of 1284 1836 msedge.exe 85 PID 1836 wrote to memory of 1284 1836 msedge.exe 85 PID 1836 wrote to memory of 1284 1836 msedge.exe 85 PID 1836 wrote to memory of 1284 1836 msedge.exe 85 PID 1836 wrote to memory of 1284 1836 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91ea13b928ac0f6da0f6ee7cd5204117_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc074f46f8,0x7ffc074f4708,0x7ffc074f47182⤵PID:2956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,7731935338631560145,15377335858247263225,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:4492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,7731935338631560145,15377335858247263225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,7731935338631560145,15377335858247263225,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:82⤵PID:1284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7731935338631560145,15377335858247263225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:3116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7731935338631560145,15377335858247263225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,7731935338631560145,15377335858247263225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:82⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,7731935338631560145,15377335858247263225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7731935338631560145,15377335858247263225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:12⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7731935338631560145,15377335858247263225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:12⤵PID:1408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7731935338631560145,15377335858247263225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:2644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7731935338631560145,15377335858247263225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:12⤵PID:332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,7731935338631560145,15377335858247263225,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3772
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2432
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c624d29-3233-4ed1-9362-cb9a2f863a43.tmp
Filesize5KB
MD5e921ae50d249cfe0099f84f2b47b8b20
SHA14c3e466cc10181b7f4b706e77c43eb5a3b1fc1ff
SHA256bdc52411d0595a6079534edabdb4c2eb4b634eee963dfeb768c539846c1185c6
SHA5120fb065a4b30762380d1532c798b592c6650b30d833f4d06985fb352d47e820322b180a45fac6f6be36840f1058e5e31f35fff3094df934bb983b65538b848a0d
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
724B
MD573c67fc1b4c1e2da6f0988c0a609b63e
SHA135254f51d9709211638cf40c24c0c180df501a9d
SHA2567b0f582217ea72d8d784d730ccbf3ddb7e9ce22da138c2345acc5bdee521a920
SHA512ac876a6fc624cf1261ca0807d98145caa44f6286fbe489cd776a0e964ddf3265b8935564c571a2ce0086ea45e02d30f4a7108610a4edb98de509b091f6efd5fe
-
Filesize
6KB
MD5a53d779420e393a22b56389876a8a6d2
SHA1214b2d3a59b93725e2d8c500e5faf0bf67026334
SHA256e738cc7b27ce6bf7e5dd08c76ff6c16dd0309c526d894147f59f816a37f39291
SHA512ca81dfef8c7a601711357c64588238253ab6fab3cd64a55efdf786fadab076252037ea667f6f729aa1aee76089a6e2f6e3cc59e47126a6458345cbfebd4b75e3
-
Filesize
6KB
MD51421a35133df05ea6bb38751e562fe19
SHA1f3b0749c0a0c8daf4fbf19d557ef2407b7d3d26e
SHA256093d6d90888cf2f4f5c98984cdc4a333f7208ea03a395b3e664d4f18ea124e42
SHA5121450aa2279889f6ee20e9f2c896589e8fe98be02afa37986e838a08c123e22e284a46ef3a365355e1db84052c2b76658ba4c86f9be23b9b64d773078bf4de1c9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5d98a53e721863d521317c2d3c3c7fa12
SHA13fdaee5f47ce8a73bd72345f9fa65f15150d765c
SHA2563aa36f7bc753b8963ed5788a7146a30eb38e7f31733b34a884c9a52d68509caa
SHA5120f24b3f38e71454f3685753e64eadd6c32d12525f2eb1e192dfd225e488db6d4eb33282cc3985e93d6f75e0d5c5fc259af3d929ad4faf2cfb7667c3d319406b0