Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 19:50
Static task
static1
Behavioral task
behavioral1
Sample
9b792395dbc4a8a23fbb911d2b417d90_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
9b792395dbc4a8a23fbb911d2b417d90_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9b792395dbc4a8a23fbb911d2b417d90_JaffaCakes118.html
-
Size
131KB
-
MD5
9b792395dbc4a8a23fbb911d2b417d90
-
SHA1
301725c25f4fab5c3a7bf2e6764946f3bc7be901
-
SHA256
06ee72af043a61fce467d03e2de05c5aacbb2a577cacf276d8eab03f03bc2294
-
SHA512
5b3ac15ac7fcb416de4f1c3c90a40cfdec6e26b50d5baf00fe64c5ae8bb334ef7baeca6c277d2a447cf8ddc821ba6b6f56b63d432b737ecf1079b87ecb32421f
-
SSDEEP
3072:Sb7JjRFTf2AHS3M2Bq3BkLi8Zw/UnOSLJwfHIXxuUZQP/HBU:Sbp2AHS3M2Bq3BkLi8Zw/UnOSLJwfHIt
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2848 msedge.exe 2848 msedge.exe 4844 msedge.exe 4844 msedge.exe 4388 identity_helper.exe 4388 identity_helper.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe 4844 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4844 wrote to memory of 1760 4844 msedge.exe 82 PID 4844 wrote to memory of 1760 4844 msedge.exe 82 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 3972 4844 msedge.exe 83 PID 4844 wrote to memory of 2848 4844 msedge.exe 84 PID 4844 wrote to memory of 2848 4844 msedge.exe 84 PID 4844 wrote to memory of 528 4844 msedge.exe 85 PID 4844 wrote to memory of 528 4844 msedge.exe 85 PID 4844 wrote to memory of 528 4844 msedge.exe 85 PID 4844 wrote to memory of 528 4844 msedge.exe 85 PID 4844 wrote to memory of 528 4844 msedge.exe 85 PID 4844 wrote to memory of 528 4844 msedge.exe 85 PID 4844 wrote to memory of 528 4844 msedge.exe 85 PID 4844 wrote to memory of 528 4844 msedge.exe 85 PID 4844 wrote to memory of 528 4844 msedge.exe 85 PID 4844 wrote to memory of 528 4844 msedge.exe 85 PID 4844 wrote to memory of 528 4844 msedge.exe 85 PID 4844 wrote to memory of 528 4844 msedge.exe 85 PID 4844 wrote to memory of 528 4844 msedge.exe 85 PID 4844 wrote to memory of 528 4844 msedge.exe 85 PID 4844 wrote to memory of 528 4844 msedge.exe 85 PID 4844 wrote to memory of 528 4844 msedge.exe 85 PID 4844 wrote to memory of 528 4844 msedge.exe 85 PID 4844 wrote to memory of 528 4844 msedge.exe 85 PID 4844 wrote to memory of 528 4844 msedge.exe 85 PID 4844 wrote to memory of 528 4844 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9b792395dbc4a8a23fbb911d2b417d90_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9278146f8,0x7ff927814708,0x7ff9278147182⤵PID:1760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,7608072235366771367,16807089817356781515,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:22⤵PID:3972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,7608072235366771367,16807089817356781515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,7608072235366771367,16807089817356781515,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:82⤵PID:528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7608072235366771367,16807089817356781515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7608072235366771367,16807089817356781515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7608072235366771367,16807089817356781515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:12⤵PID:3236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,7608072235366771367,16807089817356781515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:82⤵PID:4692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,7608072235366771367,16807089817356781515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7608072235366771367,16807089817356781515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:12⤵PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7608072235366771367,16807089817356781515,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:12⤵PID:2756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7608072235366771367,16807089817356781515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1464 /prefetch:12⤵PID:1484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7608072235366771367,16807089817356781515,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2748 /prefetch:12⤵PID:1912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,7608072235366771367,16807089817356781515,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4360 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:412
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4120
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
Filesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6e7bfb6c-cdb2-4a6f-bc12-a3cba6b8164d.tmp
Filesize6KB
MD58e49307bd35fed351687d8a7e46fed63
SHA106aea8de102174dc4ca410f4e08f58ab4ac7dabf
SHA2561fca3dd4aa58c63418edde3688db3f43019ff8c5edd567944468f0f62504cc54
SHA512892ccac63d2ece125335550a8bc7a1b89763986741cf1cce886d94e0ad26b6b1316019fb9f79c07eb3ec35d5fc5608272b67dd1083db4a75acaa30f6cb8784a4
-
Filesize
5KB
MD55865ab8f86a319e30b12ea02cc89dc1b
SHA16b849a8048eedaf2972a0a0d6036bcc748775580
SHA2567386d7b69baafc874ba1f07abe1afcdc55387adec37bdb5182b91da587326f71
SHA5124ae875e18bfbb11f7bb3368dd8418cad676f8484aa2cb4b602bfee2441ba344906942827b212a7c118dcdd8e3b51dec0a7e30cd66963f1ff8425252823bbf049
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD583c9f9ec066508527669b9b5b5c9c329
SHA1854949b16775e794be67c835d1ee39689fa17e96
SHA2562f558a5116b69fa5baf2a3d29f4db4ccc9b0921a5a36509bbfb1a070d9346c55
SHA5127fbee0ddb164a94c634712d64dcf468728b61c53d9b9c73602a8f0fb6fd2338c2888dde01f7350e85e753ce93d13a75a12727a24ba9b8deee4cb5f57bd3e3b0d