Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 15:33
Static task
static1
Behavioral task
behavioral1
Sample
a12afa55e47f22ef973b67e23f5fbdca_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a12afa55e47f22ef973b67e23f5fbdca_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a12afa55e47f22ef973b67e23f5fbdca_JaffaCakes118.html
-
Size
36KB
-
MD5
a12afa55e47f22ef973b67e23f5fbdca
-
SHA1
9a50f7c58014cab456110a057100a5c17a6752c4
-
SHA256
86b6212faf28156234a71878c6c81012c16fb9986078b393c34d3d176849e1b7
-
SHA512
c66112f8dd1b6fb53d870ef0285492fa744ec20bd2043a54a707f6a482fab969db06c0623e82853d7a6f984bca17423b67ba8ad2f9e0dfef73a9fdbae94acfff
-
SSDEEP
768:zwx/MDTH8G88hAR7ZPXCE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TIZOW6DJtxo6lLl:Q/fbJxNVWu0Sb/388K
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 8 msedge.exe 8 msedge.exe 3860 msedge.exe 3860 msedge.exe 4136 identity_helper.exe 4136 identity_helper.exe 3732 msedge.exe 3732 msedge.exe 3732 msedge.exe 3732 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3860 wrote to memory of 4448 3860 msedge.exe 81 PID 3860 wrote to memory of 4448 3860 msedge.exe 81 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 972 3860 msedge.exe 82 PID 3860 wrote to memory of 8 3860 msedge.exe 83 PID 3860 wrote to memory of 8 3860 msedge.exe 83 PID 3860 wrote to memory of 3588 3860 msedge.exe 84 PID 3860 wrote to memory of 3588 3860 msedge.exe 84 PID 3860 wrote to memory of 3588 3860 msedge.exe 84 PID 3860 wrote to memory of 3588 3860 msedge.exe 84 PID 3860 wrote to memory of 3588 3860 msedge.exe 84 PID 3860 wrote to memory of 3588 3860 msedge.exe 84 PID 3860 wrote to memory of 3588 3860 msedge.exe 84 PID 3860 wrote to memory of 3588 3860 msedge.exe 84 PID 3860 wrote to memory of 3588 3860 msedge.exe 84 PID 3860 wrote to memory of 3588 3860 msedge.exe 84 PID 3860 wrote to memory of 3588 3860 msedge.exe 84 PID 3860 wrote to memory of 3588 3860 msedge.exe 84 PID 3860 wrote to memory of 3588 3860 msedge.exe 84 PID 3860 wrote to memory of 3588 3860 msedge.exe 84 PID 3860 wrote to memory of 3588 3860 msedge.exe 84 PID 3860 wrote to memory of 3588 3860 msedge.exe 84 PID 3860 wrote to memory of 3588 3860 msedge.exe 84 PID 3860 wrote to memory of 3588 3860 msedge.exe 84 PID 3860 wrote to memory of 3588 3860 msedge.exe 84 PID 3860 wrote to memory of 3588 3860 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a12afa55e47f22ef973b67e23f5fbdca_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fd0746f8,0x7ff8fd074708,0x7ff8fd0747182⤵PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,5893587409213782081,2202256372081080136,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:22⤵PID:972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,5893587409213782081,2202256372081080136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2580 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:8
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,5893587409213782081,2202256372081080136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:82⤵PID:3588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5893587409213782081,2202256372081080136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5893587409213782081,2202256372081080136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:1716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,5893587409213782081,2202256372081080136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:82⤵PID:1880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,5893587409213782081,2202256372081080136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5893587409213782081,2202256372081080136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:12⤵PID:4960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5893587409213782081,2202256372081080136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:12⤵PID:2372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5893587409213782081,2202256372081080136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1872 /prefetch:12⤵PID:1464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5893587409213782081,2202256372081080136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:12⤵PID:2440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,5893587409213782081,2202256372081080136,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4356 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3732
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3468
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
5KB
MD50cf7d0317e5a151982a8d10033d12228
SHA1f0617e2947d9b31eb51a7a6d90b2427843cbf495
SHA25615eac08946bd9a8f64d1e22fe9b2aeb97b26003f4c742f4182bde14b3e61478f
SHA512662c3e502f4904e344488de2ceb57efc3a1096efb45addf7daf4664787192f445aa6abb42c64e3ca615d6854f82ba9ea257ab5407aebc227e0874063689120f0
-
Filesize
6KB
MD5d669cc8e32e01fb04b4068273a417fd7
SHA1fd6f4a94a36460a8701fbc21be75a84a730fb7f9
SHA256f9571b777bc2b82222544b46af96fba98cd19472612ce6ba3ad204cf970efc74
SHA512d15d82d9abdda51d84a1e29124f14b8e16335dd946ac8bbe296fba544853f5d794c49901041a01cce799e59ec09694003ee20b7d4918f6e1a0f53e641c6c4714
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
8KB
MD5c534535d5fc450b63424cd91070798b6
SHA1bdf4cbb9a93146c4eb8287d06042c120e1dff258
SHA25685d149bfd28615193fc729c941fb4794bbcfe0ffa4f88c2eb57b97a931116537
SHA51239096851150bbb1c42f925a33f461ba072666e9da5b6014982b6b189cf8afea2bbeb49410cea47d65bf53c1d6ae7d91b1a5c3e8c5b886ea145bc5175c1099820