Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 15:08
Static task
static1
Behavioral task
behavioral1
Sample
a119c3069dd5cac07da1399477ea5d23_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a119c3069dd5cac07da1399477ea5d23_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a119c3069dd5cac07da1399477ea5d23_JaffaCakes118.html
-
Size
23KB
-
MD5
a119c3069dd5cac07da1399477ea5d23
-
SHA1
752fd3186d1f88d53ca0d24460eabe49504b5156
-
SHA256
b6f2900fbd2cbd01c83462ab1229b89fc0be40db89c139910292ed4d396c2ff6
-
SHA512
8a3d5c4d01f21807c777aa9bb640146bb35fcf9bb6c19b147dc2900ba94c14691cbc66b9f0c21d9ff3e9c2f4a5a27a12d9086377b6a8199af4494f889574f55f
-
SSDEEP
192:uwXjb5neenQjxn5Q/NnQieYNnBnQOkEntv3nQTbnZnQKdjivMB4qnYnQ7tn+YEnh:MQ/YliN
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1720 msedge.exe 1720 msedge.exe 4592 msedge.exe 4592 msedge.exe 4012 identity_helper.exe 4012 identity_helper.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe 4592 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4592 wrote to memory of 2364 4592 msedge.exe 81 PID 4592 wrote to memory of 2364 4592 msedge.exe 81 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 448 4592 msedge.exe 82 PID 4592 wrote to memory of 1720 4592 msedge.exe 83 PID 4592 wrote to memory of 1720 4592 msedge.exe 83 PID 4592 wrote to memory of 3240 4592 msedge.exe 84 PID 4592 wrote to memory of 3240 4592 msedge.exe 84 PID 4592 wrote to memory of 3240 4592 msedge.exe 84 PID 4592 wrote to memory of 3240 4592 msedge.exe 84 PID 4592 wrote to memory of 3240 4592 msedge.exe 84 PID 4592 wrote to memory of 3240 4592 msedge.exe 84 PID 4592 wrote to memory of 3240 4592 msedge.exe 84 PID 4592 wrote to memory of 3240 4592 msedge.exe 84 PID 4592 wrote to memory of 3240 4592 msedge.exe 84 PID 4592 wrote to memory of 3240 4592 msedge.exe 84 PID 4592 wrote to memory of 3240 4592 msedge.exe 84 PID 4592 wrote to memory of 3240 4592 msedge.exe 84 PID 4592 wrote to memory of 3240 4592 msedge.exe 84 PID 4592 wrote to memory of 3240 4592 msedge.exe 84 PID 4592 wrote to memory of 3240 4592 msedge.exe 84 PID 4592 wrote to memory of 3240 4592 msedge.exe 84 PID 4592 wrote to memory of 3240 4592 msedge.exe 84 PID 4592 wrote to memory of 3240 4592 msedge.exe 84 PID 4592 wrote to memory of 3240 4592 msedge.exe 84 PID 4592 wrote to memory of 3240 4592 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a119c3069dd5cac07da1399477ea5d23_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee01646f8,0x7ffee0164708,0x7ffee01647182⤵PID:2364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,17865818786378219279,11568621172074039900,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,17865818786378219279,11568621172074039900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,17865818786378219279,11568621172074039900,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵PID:3240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17865818786378219279,11568621172074039900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:2140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17865818786378219279,11568621172074039900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17865818786378219279,11568621172074039900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:82⤵PID:4272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17865818786378219279,11568621172074039900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17865818786378219279,11568621172074039900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:12⤵PID:1328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17865818786378219279,11568621172074039900,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:12⤵PID:1340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17865818786378219279,11568621172074039900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:1208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17865818786378219279,11568621172074039900,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:3192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,17865818786378219279,11568621172074039900,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5344 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3500
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3936
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
Filesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
Filesize
5KB
MD5a0bd3acff3c6f0d84c89db2f90d391a9
SHA1caba03fa5853740652ca42057f02f6752d8c8473
SHA25620ddfbdb395ec418014691f577e7cb496ea9265cf19fe60c2013c28fdbd22feb
SHA512d7ad914025099387eafae44a37474b6c056d3e0a412fe6a3fb3a5a00eaed70d37d18d07217d43df9ded4995051d0d14b7fbc23b0f2c1f4415c6ef830c5709904
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb460755-b130-4c4b-afcf-d67b6683f87e.tmp
Filesize5KB
MD5e6827d367bccba61943c97bd70dfb5c6
SHA18f79d43cffe7cfe54cd1957584c6e197950fd829
SHA2561a399669c5cf8d02e47ab04b016b021d12bf61da96ccf4ada08c53c9524398e6
SHA512dbd21aa0c274872f92fa286a456403f82e1710d2c7fd79cec1a9e3a97de77f37886280fab8f7f5171b309e602061831049806c65444d88945494543f64bc7656
-
Filesize
8KB
MD54b6ec217f1112635422b1bb976de34fd
SHA1d506cef8ba799a724806d087ae562d9acaabcf84
SHA25686cd73f9207563fbd1a9717d209e9980d38c0ce7ebf873e13f3d4c3fd697c8d0
SHA512a76a013d98ff85114b9795d651e0c0e027a8214f93ae550ab83e04d6e73bd2c1434c617a958610bd93a66e2dd8814dfe3b28143abedae358fb343aa3f530937a