Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/06/2024, 02:46
Static task
static1
Behavioral task
behavioral1
Sample
936d5c3380da906ff0970c9d51945ee0_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
936d5c3380da906ff0970c9d51945ee0_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
936d5c3380da906ff0970c9d51945ee0_JaffaCakes118.html
-
Size
138KB
-
MD5
936d5c3380da906ff0970c9d51945ee0
-
SHA1
4ebaf6f2fb10da50c60651c3bfbf871f757d39f4
-
SHA256
f9f6bab1a5489c4cd8880b3ea0078b366547f92e885fe7f02654395b515689d1
-
SHA512
daf104869d7de5003b2fcc3e01c198816e1ed6554f8992418fb37534660b50da067e41f8383cd47bdfb9d89a561fba045b946a9e1d28fd6cb7c5863c6d2cde05
-
SSDEEP
1536:SkDyzk6lZyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:SkX+yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4136 msedge.exe 4136 msedge.exe 4660 msedge.exe 4660 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4660 msedge.exe 4660 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4660 wrote to memory of 4392 4660 msedge.exe 86 PID 4660 wrote to memory of 4392 4660 msedge.exe 86 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4004 4660 msedge.exe 87 PID 4660 wrote to memory of 4136 4660 msedge.exe 88 PID 4660 wrote to memory of 4136 4660 msedge.exe 88 PID 4660 wrote to memory of 1420 4660 msedge.exe 89 PID 4660 wrote to memory of 1420 4660 msedge.exe 89 PID 4660 wrote to memory of 1420 4660 msedge.exe 89 PID 4660 wrote to memory of 1420 4660 msedge.exe 89 PID 4660 wrote to memory of 1420 4660 msedge.exe 89 PID 4660 wrote to memory of 1420 4660 msedge.exe 89 PID 4660 wrote to memory of 1420 4660 msedge.exe 89 PID 4660 wrote to memory of 1420 4660 msedge.exe 89 PID 4660 wrote to memory of 1420 4660 msedge.exe 89 PID 4660 wrote to memory of 1420 4660 msedge.exe 89 PID 4660 wrote to memory of 1420 4660 msedge.exe 89 PID 4660 wrote to memory of 1420 4660 msedge.exe 89 PID 4660 wrote to memory of 1420 4660 msedge.exe 89 PID 4660 wrote to memory of 1420 4660 msedge.exe 89 PID 4660 wrote to memory of 1420 4660 msedge.exe 89 PID 4660 wrote to memory of 1420 4660 msedge.exe 89 PID 4660 wrote to memory of 1420 4660 msedge.exe 89 PID 4660 wrote to memory of 1420 4660 msedge.exe 89 PID 4660 wrote to memory of 1420 4660 msedge.exe 89 PID 4660 wrote to memory of 1420 4660 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\936d5c3380da906ff0970c9d51945ee0_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f44046f8,0x7ff8f4404708,0x7ff8f44047182⤵PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,3638936772693962581,8384570458052895773,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:4004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,3638936772693962581,8384570458052895773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,3638936772693962581,8384570458052895773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:1420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3638936772693962581,8384570458052895773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3638936772693962581,8384570458052895773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:2132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,3638936772693962581,8384570458052895773,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4804 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3220
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1512
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
6KB
MD525ce3d60f648df13a69cbabcbf6a055d
SHA142467b18bf9f0f09ef2653dd9ef2228a8933d214
SHA256fa56f7be45bfc4364ed289cdae905837caa0451e9cd11d050e3b937111e61fc3
SHA51279c7c4f09108665a19832c3225a9d8a8121bfcfad49079aa4e50f78147d858f859d09fbae5ea20512d0c8b7bb1154edb51bed1755acb189862f68e0e78c0be4e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f7fc33e1-ec6a-485d-b104-7485caccbd1a.tmp
Filesize5KB
MD5ab10287ca1f87804de1f7f62e24247ec
SHA1cc01394055e0fdf81d36411d680e783692c4831f
SHA25634d9676173dcf985f8d8a00e9b6531b73ea65b7ee26c14492a5796da1f14e14d
SHA51201610db22116b97f1dd8f2c4989c04f772cc9de2247ce2445c794ee4e1b1a34c67dfec36fd4e3fa2730474ef2eaa009a96e7c7e09c1c522be3e2e7839d6f6c35
-
Filesize
11KB
MD5031204dd11586b5a218a5ce927677726
SHA19e1580ebe3a74fabc0ee61fa026f8b9ff297ed9f
SHA2564420adcea0c38ea532652cb2aeeee2e53e7da46ee25d7e4e80a6e9f57093b17c
SHA5121d8098baebf1d2dcb72b85d22ea05fffc18ec9a7cb84835a2fb19bb13c461e1d26f9a52e6f601552031060d95245129053c33372d4b741acb3eee800a9eb072d