Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 15:09
Static task
static1
Behavioral task
behavioral1
Sample
a119fea2dfd43a5b8161fbcd6d1a50ed_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a119fea2dfd43a5b8161fbcd6d1a50ed_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a119fea2dfd43a5b8161fbcd6d1a50ed_JaffaCakes118.html
-
Size
68KB
-
MD5
a119fea2dfd43a5b8161fbcd6d1a50ed
-
SHA1
cb27cdad1436461990f41d3419d04e01e19b7139
-
SHA256
382a94a1c2f61dcfdb1ba623fc52b4fda6cb370daa7b64ababd1e4056b65f950
-
SHA512
e41c63e580dcf80cbdcdf6f981ef0ed33bf85bfd95ea070c0b789f249f1dd245a080f93de3647b30056cdd7a1905c5f1c0e272f7614114b0ef55e75b2a0b55c1
-
SSDEEP
768:JirgcMsSZ8tN99OIsiK6s+dZoT2fQCZkoTnMdtbBnfBgN8/oygcRWQFVGys//IjA:JpWzST6Pec0tbrga6crNnz8PJ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2012 msedge.exe 2012 msedge.exe 4472 msedge.exe 4472 msedge.exe 1508 identity_helper.exe 1508 identity_helper.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4472 wrote to memory of 4560 4472 msedge.exe 81 PID 4472 wrote to memory of 4560 4472 msedge.exe 81 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 1968 4472 msedge.exe 83 PID 4472 wrote to memory of 2012 4472 msedge.exe 84 PID 4472 wrote to memory of 2012 4472 msedge.exe 84 PID 4472 wrote to memory of 4620 4472 msedge.exe 85 PID 4472 wrote to memory of 4620 4472 msedge.exe 85 PID 4472 wrote to memory of 4620 4472 msedge.exe 85 PID 4472 wrote to memory of 4620 4472 msedge.exe 85 PID 4472 wrote to memory of 4620 4472 msedge.exe 85 PID 4472 wrote to memory of 4620 4472 msedge.exe 85 PID 4472 wrote to memory of 4620 4472 msedge.exe 85 PID 4472 wrote to memory of 4620 4472 msedge.exe 85 PID 4472 wrote to memory of 4620 4472 msedge.exe 85 PID 4472 wrote to memory of 4620 4472 msedge.exe 85 PID 4472 wrote to memory of 4620 4472 msedge.exe 85 PID 4472 wrote to memory of 4620 4472 msedge.exe 85 PID 4472 wrote to memory of 4620 4472 msedge.exe 85 PID 4472 wrote to memory of 4620 4472 msedge.exe 85 PID 4472 wrote to memory of 4620 4472 msedge.exe 85 PID 4472 wrote to memory of 4620 4472 msedge.exe 85 PID 4472 wrote to memory of 4620 4472 msedge.exe 85 PID 4472 wrote to memory of 4620 4472 msedge.exe 85 PID 4472 wrote to memory of 4620 4472 msedge.exe 85 PID 4472 wrote to memory of 4620 4472 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a119fea2dfd43a5b8161fbcd6d1a50ed_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffe473b46f8,0x7ffe473b4708,0x7ffe473b47182⤵PID:4560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,9884258196709311453,16985366487657401027,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵PID:1968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,9884258196709311453,16985366487657401027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,9884258196709311453,16985366487657401027,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:4620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9884258196709311453,16985366487657401027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9884258196709311453,16985366487657401027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:12⤵PID:4116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9884258196709311453,16985366487657401027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:12⤵PID:3972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,9884258196709311453,16985366487657401027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:82⤵PID:3288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,9884258196709311453,16985366487657401027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9884258196709311453,16985366487657401027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:12⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9884258196709311453,16985366487657401027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:12⤵PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9884258196709311453,16985366487657401027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:12⤵PID:2832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9884258196709311453,16985366487657401027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,9884258196709311453,16985366487657401027,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3084
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3800
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dabfafd78687947a9de64dd5b776d25f
SHA116084c74980dbad713f9d332091985808b436dea
SHA256c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
SHA512dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
-
Filesize
152B
MD5c39b3aa574c0c938c80eb263bb450311
SHA1f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA25666f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
SHA512eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD57f30a8b31530c976b38e49680283bf44
SHA1be999200d92b863ce315eac805385f279730c922
SHA256653b50004e6a1caa192d3f5330d4eb6ad2c73de51a91e2785c9612fa66c8c78f
SHA5126e78766931cb904da35c93e4e6be1e33cf355571ff3803961bc7c0468fa47cb576daad630a95204b94fe3766a4e495e12b781b8c955caecba912c1bbc4ca3c4e
-
Filesize
410B
MD5a4a70277672a5ee82ca5f0cfdbf6c702
SHA146ac82a88705c3749604e637b31e9f5e93e1ebd9
SHA256ce200f00206ae04a997c42e724baecfa0a1a9fa14bf97004c898cab8b0aea473
SHA5125f1521eef961cafdd41889bee74c78044db6ea9855b246b6572470d68bd00cfa93adbb6bab5fe87b6bb0cc6b95a07626c8757c4b253e096e4d420d905e9d92b7
-
Filesize
6KB
MD5a42fe67af26dc1804fdcef8af9b6b0e5
SHA1ab0b8188c29ac5583fc962f91c2c380fce6b63c6
SHA25655df94165a7f78297627b9036e1fb18b4ec31043d4c39891cd052d698b25bd59
SHA512fe3d7026b4da7c06e91fe56d9e87a2861c38678e21b59397bd8e1133c87c419b0744fc40c7e146813841375e0303907675c63ea08f12a1a8531b9327f6ff6d47
-
Filesize
6KB
MD52ba8d132c641ceaf7ffd2b2a3a3535c0
SHA14dfcfc45f6ba3345f2e2af69a019328b012535ce
SHA2568fdbbde7fe91b5352444a74c326937ee7cea8f9377493d70b3d6fd141d18fa79
SHA51278a85c6ffa25bbe0e21dd3918f78a25a91c5d89db04d7e28ba4dae01fffbe9228651a8d996e89b9f5cced828eab8292f97a21b2265a0417297f82b4e02d49779
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD54a832ed088be22a0d0b21850c2a20ee3
SHA1aeb5bf5679ff38f6cca049481c7bdc690c51821d
SHA25696a7831f1885c8a160cf586b061d2f963beac8feadadbbc657e3576225dec6f4
SHA512ba240fef8495810afbe03e31fb82b95e9b1f053ec18dcb5715bd00d4da4d8073417c1f0a4279bb77559ee0453e11acbad2da912f7f3c0e34d73485dfa0ebec3a