Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 12:19
Static task
static1
Behavioral task
behavioral1
Sample
94d136e53980fd5bd2c599937d533fa3_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
94d136e53980fd5bd2c599937d533fa3_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
94d136e53980fd5bd2c599937d533fa3_JaffaCakes118.html
-
Size
36KB
-
MD5
94d136e53980fd5bd2c599937d533fa3
-
SHA1
dfa0b4c6e633b80ba368a023b74694bcbc2aad31
-
SHA256
99b375016692015d5aeb6cf950bf5ef2f4a3b78a40be9e7c3e8bbbdfe0786a4e
-
SHA512
30164faae2edb79d92b4747491b99f99a2cfcdbfb60830f891a96705e79b7dd1479d4b678330ce9f7488d75d3de41deb1b12ca226349d15dcb3bc3a82a2967c3
-
SSDEEP
768:P4FQW81D4RA+vEOjz6rdG2Gil54RZfPGnf3Gu34a0i6781DdRA4vEOjq6h8aRlR9:gFQW81D4RA+vEOjz6raA7IazC81DdRAW
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4072 msedge.exe 4072 msedge.exe 2136 msedge.exe 2136 msedge.exe 4760 identity_helper.exe 4760 identity_helper.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2136 wrote to memory of 1944 2136 msedge.exe 81 PID 2136 wrote to memory of 1944 2136 msedge.exe 81 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 1748 2136 msedge.exe 82 PID 2136 wrote to memory of 4072 2136 msedge.exe 83 PID 2136 wrote to memory of 4072 2136 msedge.exe 83 PID 2136 wrote to memory of 2472 2136 msedge.exe 84 PID 2136 wrote to memory of 2472 2136 msedge.exe 84 PID 2136 wrote to memory of 2472 2136 msedge.exe 84 PID 2136 wrote to memory of 2472 2136 msedge.exe 84 PID 2136 wrote to memory of 2472 2136 msedge.exe 84 PID 2136 wrote to memory of 2472 2136 msedge.exe 84 PID 2136 wrote to memory of 2472 2136 msedge.exe 84 PID 2136 wrote to memory of 2472 2136 msedge.exe 84 PID 2136 wrote to memory of 2472 2136 msedge.exe 84 PID 2136 wrote to memory of 2472 2136 msedge.exe 84 PID 2136 wrote to memory of 2472 2136 msedge.exe 84 PID 2136 wrote to memory of 2472 2136 msedge.exe 84 PID 2136 wrote to memory of 2472 2136 msedge.exe 84 PID 2136 wrote to memory of 2472 2136 msedge.exe 84 PID 2136 wrote to memory of 2472 2136 msedge.exe 84 PID 2136 wrote to memory of 2472 2136 msedge.exe 84 PID 2136 wrote to memory of 2472 2136 msedge.exe 84 PID 2136 wrote to memory of 2472 2136 msedge.exe 84 PID 2136 wrote to memory of 2472 2136 msedge.exe 84 PID 2136 wrote to memory of 2472 2136 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\94d136e53980fd5bd2c599937d533fa3_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84b6d46f8,0x7ff84b6d4708,0x7ff84b6d47182⤵PID:1944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,6537423712755388674,2539861498456788982,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:1748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,6537423712755388674,2539861498456788982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,6537423712755388674,2539861498456788982,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:2472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6537423712755388674,2539861498456788982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:2820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6537423712755388674,2539861498456788982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:3144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,6537423712755388674,2539861498456788982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:82⤵PID:2564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,6537423712755388674,2539861498456788982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6537423712755388674,2539861498456788982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2204 /prefetch:12⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6537423712755388674,2539861498456788982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:12⤵PID:220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6537423712755388674,2539861498456788982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:12⤵PID:1924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6537423712755388674,2539861498456788982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:12⤵PID:1536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,6537423712755388674,2539861498456788982,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2172
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3808
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
Filesize
572B
MD5050578309c64b36e65aed8d2da316e48
SHA163cc0af516596fc199a4c2496ca104a6d2799d53
SHA2563ba1ae7bf10c3091cae5974178588fbf8bfac02261e3d68fa9b543a0fac02fb0
SHA512945d31a9c0d015696cc9255cf5f9f2728633d8125a23ee2551e8823f3919e4c2c99f9a9a5a47e232e5249110b8193d31c9db32bd6d5104c842213e54d6e77e04
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD5ba7fe65accbb2e77949d2be828520997
SHA17de80afd1baa1c4ea72b8162ba5bea252fa57381
SHA2566f982fbb1026c275112637db010bb8fe3111a0680dee958c077ae2acf83c764e
SHA512981a4bf6843797f95c43b610ec1d182df10163c3979bd52d0e9063d23c35e19e37e40dd98ba974a739281b782820535418ec8fcf2106617d7f61e41f57dcaf1e
-
Filesize
6KB
MD5522d9899e661cd4eda036b6aab132abe
SHA13f5aa2fb251c105dd8bb22331e5832a39f062dde
SHA256f091bcce2037b07a381a9f1be54bb7c7382451da737aa7d809609c9cc17eea17
SHA51221daea1aad4650f8998f8f85a4ecc977d1d33be67a283df88aaa2a5e59aee8cc915379b23f9c8f0fadb2210ff39fb4995ab21a4a1ab494a6c3017642985636eb
-
Filesize
6KB
MD5e9d24076e8065ddd4302558babd87481
SHA104f078c8e5fe3462d5dc8aceddca51e80276f1a7
SHA2565ef569b1f0566843a8321177692074c427dc3cc04b4d8ddddc2482bd260e0d13
SHA512f3fe6b837e1178e64937ce892d2a3bb5e0f6c0b73757472a78d95dbba4666b69dac65fcef867247da272982686a9a5d1e7f7a38554dde16a50cf7209b5d61dcf
-
Filesize
6KB
MD5b4f088a7b4adfa69982a52d9f80c5d0d
SHA1bb7bdd8437d7b787698103c6f5d224344d1f5794
SHA256fc1c7a1300078ce1620c4d70771f1ded94f947bf7412decbf9245e77d4ed6fdc
SHA5125649ff4135a62f2da1f1f77900b2a6550fa5e1f73e17b15c1cfc6a5f247580f0c0cc6443cf38826f99e849a67eef433f984a9e28a33b2b828264ac53ec44c226
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD51be4002d4ae8884cc0bb1fcd16a6d39b
SHA1131a4042132111f76a60d894d74f12b0fdbe88b7
SHA256120336ecd5578442c6facb2af8da9edb3705f731fdc7f81be3cd1846853b8c74
SHA512345eebd98216d5f7d134702f6e2c2827c7815c26323ec0bb2fd5bd258d299f9ae29399c93d378acc89716d0a0b0b567a8aae4b369bc5784e1e2372162f4204c3