Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 22:59
Static task
static1
Behavioral task
behavioral1
Sample
a2d2778be998998ed954f3ad8bfb811e_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a2d2778be998998ed954f3ad8bfb811e_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a2d2778be998998ed954f3ad8bfb811e_JaffaCakes118.html
-
Size
139KB
-
MD5
a2d2778be998998ed954f3ad8bfb811e
-
SHA1
254afca002479b73be2dcc65d3853e5fd06d1804
-
SHA256
38368093531c559281116a503d9793addf4578875348feb9cae26e7c7c0ff227
-
SHA512
59eca5c6c0647a6de6c7cc2049cbda3b650435b6a7e4af57e64592b9e4015e5e59978c6481bfc50bee98441f8ef4a17649d368caba0cbe2d6ef35ce3e857e45b
-
SSDEEP
1536:SQH0il0hyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy+:SQGyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3624 msedge.exe 3624 msedge.exe 3488 msedge.exe 3488 msedge.exe 4540 msedge.exe 4540 msedge.exe 4540 msedge.exe 4540 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3488 msedge.exe 3488 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3488 wrote to memory of 3628 3488 msedge.exe 82 PID 3488 wrote to memory of 3628 3488 msedge.exe 82 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 4032 3488 msedge.exe 83 PID 3488 wrote to memory of 3624 3488 msedge.exe 84 PID 3488 wrote to memory of 3624 3488 msedge.exe 84 PID 3488 wrote to memory of 2632 3488 msedge.exe 85 PID 3488 wrote to memory of 2632 3488 msedge.exe 85 PID 3488 wrote to memory of 2632 3488 msedge.exe 85 PID 3488 wrote to memory of 2632 3488 msedge.exe 85 PID 3488 wrote to memory of 2632 3488 msedge.exe 85 PID 3488 wrote to memory of 2632 3488 msedge.exe 85 PID 3488 wrote to memory of 2632 3488 msedge.exe 85 PID 3488 wrote to memory of 2632 3488 msedge.exe 85 PID 3488 wrote to memory of 2632 3488 msedge.exe 85 PID 3488 wrote to memory of 2632 3488 msedge.exe 85 PID 3488 wrote to memory of 2632 3488 msedge.exe 85 PID 3488 wrote to memory of 2632 3488 msedge.exe 85 PID 3488 wrote to memory of 2632 3488 msedge.exe 85 PID 3488 wrote to memory of 2632 3488 msedge.exe 85 PID 3488 wrote to memory of 2632 3488 msedge.exe 85 PID 3488 wrote to memory of 2632 3488 msedge.exe 85 PID 3488 wrote to memory of 2632 3488 msedge.exe 85 PID 3488 wrote to memory of 2632 3488 msedge.exe 85 PID 3488 wrote to memory of 2632 3488 msedge.exe 85 PID 3488 wrote to memory of 2632 3488 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a2d2778be998998ed954f3ad8bfb811e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d18a46f8,0x7ff8d18a4708,0x7ff8d18a47182⤵PID:3628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,9738411277827157686,16879822218558865416,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:22⤵PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,9738411277827157686,16879822218558865416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,9738411277827157686,16879822218558865416,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:82⤵PID:2632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,9738411277827157686,16879822218558865416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,9738411277827157686,16879822218558865416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,9738411277827157686,16879822218558865416,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4540
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3964
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD54ad2d96b7bc1393a67a9922ecbe7d404
SHA1473ca1d099203bbe0d8e0f410aee21a82e8a0e03
SHA256a20ed79935f9719ec30589bb1279f124f15d3a8f79f3e72d33805c1b866e2f41
SHA51216751a7e7cf22f3d4219357e2943a52d4494aad0b7c0fcf0c911f136078f0ee3b0b5b0868b46885456de387ea39fa6cc7f05646d26586c42feefe0d09a8fb55a
-
Filesize
152B
MD5477462b6ad8eaaf8d38f5e3a4daf17b0
SHA186174e670c44767c08a39cc2a53c09c318326201
SHA256e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
SHA512a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
-
Filesize
152B
MD5b704c9ca0493bd4548ac9c69dc4a4f27
SHA1a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA2562ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
SHA51269c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
-
Filesize
6KB
MD5be9829f1ba9a96502a3872d1ea965a07
SHA15329cc2d5d44c7aacc10c6ddda32bbfd5f93b135
SHA256966229d14ac53dd0a994a603235fdb4bd24694ee6b2716de792d2788b7d5bb59
SHA51298168e76081e0a456b9c905c1849bc18ff4d3e1fdd0886a0a2a55a716e38836029c8fa2672efe40911c335cf0b312815be6569d84ac874f02a684ee8427742b0
-
Filesize
6KB
MD5527c64c6bf5d67f19aa551ac95a4b515
SHA1a8b5dd9be82d9ec77df211cd4f64600255b0a619
SHA256e0f4af5c2560f52a4683cbcaaa44e4d870a447cf402174695dbf4a18847f4122
SHA512eef32d4a3cdecb539f4d92fcac0ae74a9fd0e95ca065a30b62674f67f2a93119a490da7562a928ea44886dd34c529f5e166ab23e854ece48a48336ba29263f86