Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
06/06/2024, 06:40
Static task
static1
Behavioral task
behavioral1
Sample
9a293d6163028d5a9f8cd2d12c96d14e_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
9a293d6163028d5a9f8cd2d12c96d14e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9a293d6163028d5a9f8cd2d12c96d14e_JaffaCakes118.html
-
Size
19KB
-
MD5
9a293d6163028d5a9f8cd2d12c96d14e
-
SHA1
e75349a1c956ccfb95855f4ee8f8256dc32d355f
-
SHA256
9a3d6c250a9addc7ab2c9833bd5c41784dd62e8be4e221b9d3a6a54cdb846567
-
SHA512
5a76204dae4f1315d8835e7fabce4fe1ed74214f9e6d4f86f6248647688da1a222527b964d65beafe40c61c4585050048b1e0933ffa8f57c6fb132201d588645
-
SSDEEP
192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIM4GzUnjBhyE82qDB8:SIMd0I5nO9HXsvyHxDB8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2208 msedge.exe 2208 msedge.exe 4460 msedge.exe 4460 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4460 msedge.exe 4460 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4460 wrote to memory of 4996 4460 msedge.exe 82 PID 4460 wrote to memory of 4996 4460 msedge.exe 82 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 768 4460 msedge.exe 83 PID 4460 wrote to memory of 2208 4460 msedge.exe 84 PID 4460 wrote to memory of 2208 4460 msedge.exe 84 PID 4460 wrote to memory of 548 4460 msedge.exe 85 PID 4460 wrote to memory of 548 4460 msedge.exe 85 PID 4460 wrote to memory of 548 4460 msedge.exe 85 PID 4460 wrote to memory of 548 4460 msedge.exe 85 PID 4460 wrote to memory of 548 4460 msedge.exe 85 PID 4460 wrote to memory of 548 4460 msedge.exe 85 PID 4460 wrote to memory of 548 4460 msedge.exe 85 PID 4460 wrote to memory of 548 4460 msedge.exe 85 PID 4460 wrote to memory of 548 4460 msedge.exe 85 PID 4460 wrote to memory of 548 4460 msedge.exe 85 PID 4460 wrote to memory of 548 4460 msedge.exe 85 PID 4460 wrote to memory of 548 4460 msedge.exe 85 PID 4460 wrote to memory of 548 4460 msedge.exe 85 PID 4460 wrote to memory of 548 4460 msedge.exe 85 PID 4460 wrote to memory of 548 4460 msedge.exe 85 PID 4460 wrote to memory of 548 4460 msedge.exe 85 PID 4460 wrote to memory of 548 4460 msedge.exe 85 PID 4460 wrote to memory of 548 4460 msedge.exe 85 PID 4460 wrote to memory of 548 4460 msedge.exe 85 PID 4460 wrote to memory of 548 4460 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9a293d6163028d5a9f8cd2d12c96d14e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe986b46f8,0x7ffe986b4708,0x7ffe986b47182⤵PID:4996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,1856000198623676515,7695635629052507177,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:22⤵PID:768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,1856000198623676515,7695635629052507177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,1856000198623676515,7695635629052507177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:82⤵PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,1856000198623676515,7695635629052507177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,1856000198623676515,7695635629052507177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:12⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,1856000198623676515,7695635629052507177,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3464
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1052
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
5KB
MD5c1152724bafd1f8df685393aa23596f6
SHA158eb7722041e3e9b10d385e65a963857e58d890e
SHA256bb7195b8e6026db0ca1a12fb6080a28860e58b7990d7e82ea73d03c85e21adad
SHA512c5150a35774825a7f084b20b23f5a61c850b7b4c274cbac49a436f6500eb6a5bccab32bb9decc1483ba306eed1031c3a6b3618011f24b94adf17a95c195512b3
-
Filesize
6KB
MD56918428e5c584c3a9b15b61e97511a28
SHA1ebd4820e18d2bdab32c4c3f8083b3c61259f254a
SHA2565f0fe50f9bd980e27ba935e21772906d6b0c93ee6420f6929414f35f625ffdea
SHA51200e9c1b2d3c412cc81707ace49b309f0de56a51705d1a041a8a1221a77cb4c9ef697c42e476b2695ff6750e68604f16cabbdb63760921e7545370bc9045eccdf
-
Filesize
6KB
MD595ce03c2b3da25d2c572505db755c50d
SHA15ff98eba2e6c69bbdc5a7666bafb33f7d1ad4c9d
SHA25626d9326994694aa204e15d7e8f26a3b3567617462b5a1a6f205bb812066a4242
SHA5128387f445eef0f76fc389b1d0aac13cad60d1002537f71605526f20354e2b2ab1d298c9d5afa5cec5cecf980055a0f70ce87399355fc34d0b375736296a29d1f5
-
Filesize
11KB
MD5088f9ea48edf6b48436f4589d9a26641
SHA10d602f2bbf2bf9fc9665af7aa4d177f0a39ba4ae
SHA256fddd9e98c71c397bac1638a46f155faa965404d81fba48aee5e0df3ddcdc995d
SHA512dd08b5f5045283c9e3988e6bac32383da660ee15b47df2d0bc8c03f76595d368958e9b1d37eb4f70d034bb70a69ab13fe3fcb27c17ecc08cfe56f30cd15412a1