Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 23:44
Static task
static1
Behavioral task
behavioral1
Sample
a2fd131733c992322ed074ba2be4edd9_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a2fd131733c992322ed074ba2be4edd9_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a2fd131733c992322ed074ba2be4edd9_JaffaCakes118.html
-
Size
76KB
-
MD5
a2fd131733c992322ed074ba2be4edd9
-
SHA1
3787d5ce40db9d5c5267040dafea24edd750adf9
-
SHA256
cbcec4971e9751fa8ceee0e73b440d0a01fbbaa50371dd7134ac003b6dabfd6e
-
SHA512
45543a7086e4c348d7ff5f4698f9d679039021174680476803cf1fe1d8072c4933a43afd74acefdbcb37c5848edf62250ec0fc8ac121bce87e2843e5bfed0449
-
SSDEEP
1536:lXFrPbsVRmBuyBxlS4xBW+IxXMuuX5FwhpHXtwB0cWWWaVqnxc1/zeD:lXFrPbsgdvVW+IxXMuuX5FoxrcWWWagN
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4764 msedge.exe 4764 msedge.exe 1404 msedge.exe 1404 msedge.exe 5012 identity_helper.exe 5012 identity_helper.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1404 wrote to memory of 320 1404 msedge.exe 82 PID 1404 wrote to memory of 320 1404 msedge.exe 82 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 2556 1404 msedge.exe 83 PID 1404 wrote to memory of 4764 1404 msedge.exe 84 PID 1404 wrote to memory of 4764 1404 msedge.exe 84 PID 1404 wrote to memory of 3392 1404 msedge.exe 85 PID 1404 wrote to memory of 3392 1404 msedge.exe 85 PID 1404 wrote to memory of 3392 1404 msedge.exe 85 PID 1404 wrote to memory of 3392 1404 msedge.exe 85 PID 1404 wrote to memory of 3392 1404 msedge.exe 85 PID 1404 wrote to memory of 3392 1404 msedge.exe 85 PID 1404 wrote to memory of 3392 1404 msedge.exe 85 PID 1404 wrote to memory of 3392 1404 msedge.exe 85 PID 1404 wrote to memory of 3392 1404 msedge.exe 85 PID 1404 wrote to memory of 3392 1404 msedge.exe 85 PID 1404 wrote to memory of 3392 1404 msedge.exe 85 PID 1404 wrote to memory of 3392 1404 msedge.exe 85 PID 1404 wrote to memory of 3392 1404 msedge.exe 85 PID 1404 wrote to memory of 3392 1404 msedge.exe 85 PID 1404 wrote to memory of 3392 1404 msedge.exe 85 PID 1404 wrote to memory of 3392 1404 msedge.exe 85 PID 1404 wrote to memory of 3392 1404 msedge.exe 85 PID 1404 wrote to memory of 3392 1404 msedge.exe 85 PID 1404 wrote to memory of 3392 1404 msedge.exe 85 PID 1404 wrote to memory of 3392 1404 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a2fd131733c992322ed074ba2be4edd9_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff86a1346f8,0x7ff86a134708,0x7ff86a1347182⤵PID:320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5769380039544245079,6507895351563392115,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:2556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,5769380039544245079,6507895351563392115,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,5769380039544245079,6507895351563392115,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵PID:3392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5769380039544245079,6507895351563392115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:2816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5769380039544245079,6507895351563392115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:3448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5769380039544245079,6507895351563392115,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:82⤵PID:4684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5769380039544245079,6507895351563392115,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5769380039544245079,6507895351563392115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:12⤵PID:436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5769380039544245079,6507895351563392115,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:12⤵PID:4304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5769380039544245079,6507895351563392115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:12⤵PID:1836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5769380039544245079,6507895351563392115,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:12⤵PID:2504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5769380039544245079,6507895351563392115,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1952 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1720
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4252
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5567195ba35cdb1bf39ed922abf13e7a3
SHA1509e8b2e167ecb6e95e13d1bf1962994a8874410
SHA25607cb15b714009e3602ca68c50df925797ecb50566c53636c13f981caf1925908
SHA512b3b669f6400499665c3f1fc1a08bc2d2966c3f8deca7aef6d1a2f3c3735cd84f3afc0b47c59c6145afda78d488a567a3aade7fabba40559ea7af4954ae552c46
-
Filesize
152B
MD5c5abc082d9d9307e797b7e89a2f755f4
SHA154c442690a8727f1d3453b6452198d3ec4ec13df
SHA256a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
SHA512ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
-
Filesize
152B
MD5b4a74bc775caf3de7fc9cde3c30ce482
SHA1c6ed3161390e5493f71182a6cb98d51c9063775d
SHA256dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
SHA51255578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
-
Filesize
707B
MD5eeb4bbecd0d48c19b6096e61cecaa6f9
SHA11693c739575eef600061b9d9de885499ff9a5551
SHA2562b627fc2b9f80d78a14ff780deae1e920c1ac8b13e494da93ffc1ef3f05e02e1
SHA5127f83d436db9431678abac93671c35c5c7be487708084188f6f0508d3c71fdb7b8d8bd3c2eaf368fad7a10dfac6deec292236c372fb21b895c0cf11a9065d9d26
-
Filesize
6KB
MD5d5336c27be48eccb09095331b5afa0b0
SHA1d841d2950af707a8e6d00c4c39707417a63c83a2
SHA2565a23d6f6be4a2f10ee18f6c8626edb20e2de339379d2cb474195eb312f4c6982
SHA512ee0da0900aedebff1d99e84b7779de018ac6eaba7c61cb3642ffe15d7111e131f10bf74fd10895738e0e5ace2feb4672a46e36a9dc678348eb6c1b852b2975a8
-
Filesize
6KB
MD554a19393ed8245c1100eb0431bf2231f
SHA10ba4a90b425c814d4dee41067003b428d0481d2d
SHA2567e4487ba54e3f440afbf166867f6990abed3726da87166cb576d183d7cde9649
SHA512f6c81c9ad30d8b6fa9d2f6a6a1d2baedaf3d30dacaaf23ef60a5148eee47cd68cbda47aea3c905a595f4723357807abfa91a47cd180032d46d9771555396df30
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145