Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/06/2024, 02:49
Static task
static1
Behavioral task
behavioral1
Sample
936e888c77f483a48316bb38ea91996a_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
936e888c77f483a48316bb38ea91996a_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
936e888c77f483a48316bb38ea91996a_JaffaCakes118.html
-
Size
29KB
-
MD5
936e888c77f483a48316bb38ea91996a
-
SHA1
da551fdbfc5ff85e13ef802a1925e4d21dbd0ed1
-
SHA256
09916e1d1c9a3bb45d9990a7bb21595067208b9db97a09fe851586ff427b55a9
-
SHA512
34103f5f31f4603e8216adfc43dac30005d449c04f2b5ff290bb143ca646a144d4be009493521c7892bd08793b84dbf30e93dc5e6b866afae0b9de8999ca7bc8
-
SSDEEP
384:9rIIdA8Qq/Lwl5Nj/wm2P6MnS/MC22WI4N0abv1oz4mTJXP99zziPh:9xdvi5Nj44/ofNDNQF7WPh
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3352 msedge.exe 3352 msedge.exe 3664 msedge.exe 3664 msedge.exe 3800 identity_helper.exe 3800 identity_helper.exe 1616 msedge.exe 1616 msedge.exe 1616 msedge.exe 1616 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3664 wrote to memory of 3028 3664 msedge.exe 83 PID 3664 wrote to memory of 3028 3664 msedge.exe 83 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 1684 3664 msedge.exe 84 PID 3664 wrote to memory of 3352 3664 msedge.exe 85 PID 3664 wrote to memory of 3352 3664 msedge.exe 85 PID 3664 wrote to memory of 2948 3664 msedge.exe 86 PID 3664 wrote to memory of 2948 3664 msedge.exe 86 PID 3664 wrote to memory of 2948 3664 msedge.exe 86 PID 3664 wrote to memory of 2948 3664 msedge.exe 86 PID 3664 wrote to memory of 2948 3664 msedge.exe 86 PID 3664 wrote to memory of 2948 3664 msedge.exe 86 PID 3664 wrote to memory of 2948 3664 msedge.exe 86 PID 3664 wrote to memory of 2948 3664 msedge.exe 86 PID 3664 wrote to memory of 2948 3664 msedge.exe 86 PID 3664 wrote to memory of 2948 3664 msedge.exe 86 PID 3664 wrote to memory of 2948 3664 msedge.exe 86 PID 3664 wrote to memory of 2948 3664 msedge.exe 86 PID 3664 wrote to memory of 2948 3664 msedge.exe 86 PID 3664 wrote to memory of 2948 3664 msedge.exe 86 PID 3664 wrote to memory of 2948 3664 msedge.exe 86 PID 3664 wrote to memory of 2948 3664 msedge.exe 86 PID 3664 wrote to memory of 2948 3664 msedge.exe 86 PID 3664 wrote to memory of 2948 3664 msedge.exe 86 PID 3664 wrote to memory of 2948 3664 msedge.exe 86 PID 3664 wrote to memory of 2948 3664 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\936e888c77f483a48316bb38ea91996a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8591c46f8,0x7ff8591c4708,0x7ff8591c47182⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,16317356376052786089,14319694725924232543,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:22⤵PID:1684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,16317356376052786089,14319694725924232543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,16317356376052786089,14319694725924232543,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2268 /prefetch:82⤵PID:2948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16317356376052786089,14319694725924232543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:2440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16317356376052786089,14319694725924232543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:4836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16317356376052786089,14319694725924232543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:12⤵PID:628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16317356376052786089,14319694725924232543,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:12⤵PID:696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,16317356376052786089,14319694725924232543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:82⤵PID:2024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,16317356376052786089,14319694725924232543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16317356376052786089,14319694725924232543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:12⤵PID:3908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,16317356376052786089,14319694725924232543,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:2064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,16317356376052786089,14319694725924232543,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1616
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2720
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1272
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
188B
MD5ea2251a837fe69cb0fc810d5be987677
SHA1e7de451ee86d0d3093d939b987769be9b6560e64
SHA2561d013ada09e9f20b03c3c8abcac4ddcbc5e877ac848956f8d67314b7c709aed2
SHA512c48af445e4e45ee8f145835feb220f8a5fb96a26518200cdef5558ac0a2ca27dede01dbe491e9c5985f5e8b6fabe5be751fb664f7bf0c3dcf504b88c4d0af1cf
-
Filesize
5KB
MD5d2a8dff2cb75dafc2ba57afaff8d9033
SHA1c746fc84aad261bdc37839274397294bc939195d
SHA25609cd63447defbbf162e8da9d36b38865e916475ebd301bc0052782a4846ae19e
SHA512ef20f1983a41ec3ebf43aa6bd4f2857803aa089ede8345226db94871f29888b54be51646e0e6e5d91a7cfaa4f7c43d8b85c594a3444067578c4d4587c6063922
-
Filesize
6KB
MD5b45120b9c59995fbab9c6c4ebba89e59
SHA12664e3f7e541c9c7a800ee1f9ddf02d059e6781b
SHA256522bd721587018889fb63f43eb1174a811a4e2c9590757781273e25430cd2c2d
SHA512ee85fb62016e69e96f890a2033ce53e47c1c7130d8d1466df905c559726902ea67ac126c48e5ced1ccc4f59597aa04b4a6b506e944d4b9554d5786513496082a
-
Filesize
203B
MD54937e5c0c0c03725b642c32dd3d8c71c
SHA1bbde2c36d0f5e51b2d7d8d71c11234173093c2d2
SHA256e50b06177eef5703bea3c2bc895c6c4686ff73b3c12566dd1ad1c2b76b86156b
SHA51243250f11ee551ebd321520aaf446891794fe4f40e8856cecb26cb8778d00c1981984fd3c4711746d13d6c6bec4c8c0dcc3ba9c2beb8877aa669d2754e8fcd6c2
-
Filesize
203B
MD50a5b852462aa34f07bf3bc83cdb7f280
SHA1a2e627ae926b337339c201669e6917413061cf62
SHA256a584c3445a93796d6354cef7eeb119d8e9f444016673e430b5e8c7b59890d457
SHA5126379eceda50ead2bc9a1a2229b36d9fceb3319e362f7c742397fa81a54863e83e4f0ca61fa66c0a3341d40a19771c069dd808d4c29f27e8ed6dc4ba16a32f70c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD55be4786949f4ee870fd95f9d1c67042f
SHA1b5312600d7593fa1af54f11fd650a9411527bd20
SHA2560e61a7723fd2bd3310687435483ccc46cd0bc9a157dad76e9f56320fb469310c
SHA5121fc5e72905ec945fcd7541be9fc9ff695dad7dcaac30ec25e7d9031fcf67bef4123d714b39ac97b608461aa25fd515e604e8fac38048845ed7b347a15e6d1b9d