Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 21:17
Static task
static1
Behavioral task
behavioral1
Sample
9bf4c269ec87bb0509285b2faa56d40c_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
9bf4c269ec87bb0509285b2faa56d40c_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
9bf4c269ec87bb0509285b2faa56d40c_JaffaCakes118.html
-
Size
184KB
-
MD5
9bf4c269ec87bb0509285b2faa56d40c
-
SHA1
b840e44f4464c9ad2d2239fd03237ccda92c1648
-
SHA256
d9c24d57188360b4f7dffa6438fbe8e76ec76209a6819613cb6ec432daa314e6
-
SHA512
621f4c8d495755648c843e7e1ecac522ac84f88b11fcd8e19154e8fcd58cc8870625b75644ef0515a1ffdd24b4903e0c97208e46ee27575f1ba4cbe3ed69ce08
-
SSDEEP
3072:S3RgyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFis:S3RdsMYod+X3oI+Yn86/U9jFis
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exemsedge.exepid process 2504 msedge.exe 2504 msedge.exe 3068 msedge.exe 3068 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
msedge.exepid process 3068 msedge.exe 3068 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe 3068 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3068 wrote to memory of 3156 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 3156 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 4928 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 2504 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 2504 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe PID 3068 wrote to memory of 1148 3068 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9bf4c269ec87bb0509285b2faa56d40c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1a3646f8,0x7ffb1a364708,0x7ffb1a3647182⤵PID:3156
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,2744696640238285192,16832900936737337072,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:22⤵PID:4928
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,2744696640238285192,16832900936737337072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2504 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,2744696640238285192,16832900936737337072,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:82⤵PID:1148
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,2744696640238285192,16832900936737337072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2948
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,2744696640238285192,16832900936737337072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4032
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,2744696640238285192,16832900936737337072,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4668 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5112
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3900
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
Filesize
5KB
MD564e1086be0be44848e98f1acc8eaf3c2
SHA16e2ecfb9fd7ca649fa8772845550b5609519510b
SHA256dbecf1bd60270e569f3bf1d8ad96fbfcce77579b707eaf340efcb53851c16d54
SHA512676007b63a41b26a866c281c0f8191a5e1eebc16142f129798dfe5c1c23977a80251431eb0fcba39badc19647d9bfa35e9535a38dd78e6e9897979d6f58a1ec9
-
Filesize
6KB
MD539a94d723df05cc8384da8145cc98bc4
SHA1be2c9f9d7a97519fec9c27049213a23dcc38afe4
SHA256a7bd39b4d2ee240454d8e246b4e838bf7346d92c9753b6a7f00dd9fdc3696a35
SHA51263f94a2e2fc6b63c5de7aee925c21c1a1f45322075ac4e0346ad1e2209c8b8dc76e2ff5fa49b63a037b06668d5423280bf50259d8e0f498e1849ca39ba4b3fcf
-
Filesize
10KB
MD5498f755aa7961de8d1fd9773f3e71ebe
SHA1a0932167b9fb6f4a52d84947f5f6e72c206d509c
SHA2563abef9763d47a5c7f61f18dc514f1b95d425c0d20ba7e9be3cca6d261005d458
SHA5127189bab6d61df47d28c0fb496b651a5ca2864be2e1f8c87e4b460919fc1cb129cf7eb65f9fa94ac5cbfbd1f7eead3423a41efc0b5974e4a137270191c3a5d8ef
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e