Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 16:33
Static task
static1
Behavioral task
behavioral1
Sample
a158d6928b0a20ad5ba65595c6bf5421_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
a158d6928b0a20ad5ba65595c6bf5421_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a158d6928b0a20ad5ba65595c6bf5421_JaffaCakes118.html
-
Size
4KB
-
MD5
a158d6928b0a20ad5ba65595c6bf5421
-
SHA1
edce92538f07a00ce13f6a8d793a86e4f6dd7a60
-
SHA256
a9ad71074de837541314c6a3ae3077410a7a1d70d9a79fc87c397799d930a96b
-
SHA512
1e48c72ce4c5392bfc21f88f188e71ca59e3dcbdccc19ab1253ca4dc182c20dba5479692572dedd70187a01a2fa5286b54966f472618b1f83cd9785df2e5cee7
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8ozUNrKd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDg
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2108 msedge.exe 2108 msedge.exe 1944 msedge.exe 1944 msedge.exe 4112 identity_helper.exe 4112 identity_helper.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1944 wrote to memory of 680 1944 msedge.exe 80 PID 1944 wrote to memory of 680 1944 msedge.exe 80 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2116 1944 msedge.exe 81 PID 1944 wrote to memory of 2108 1944 msedge.exe 82 PID 1944 wrote to memory of 2108 1944 msedge.exe 82 PID 1944 wrote to memory of 636 1944 msedge.exe 83 PID 1944 wrote to memory of 636 1944 msedge.exe 83 PID 1944 wrote to memory of 636 1944 msedge.exe 83 PID 1944 wrote to memory of 636 1944 msedge.exe 83 PID 1944 wrote to memory of 636 1944 msedge.exe 83 PID 1944 wrote to memory of 636 1944 msedge.exe 83 PID 1944 wrote to memory of 636 1944 msedge.exe 83 PID 1944 wrote to memory of 636 1944 msedge.exe 83 PID 1944 wrote to memory of 636 1944 msedge.exe 83 PID 1944 wrote to memory of 636 1944 msedge.exe 83 PID 1944 wrote to memory of 636 1944 msedge.exe 83 PID 1944 wrote to memory of 636 1944 msedge.exe 83 PID 1944 wrote to memory of 636 1944 msedge.exe 83 PID 1944 wrote to memory of 636 1944 msedge.exe 83 PID 1944 wrote to memory of 636 1944 msedge.exe 83 PID 1944 wrote to memory of 636 1944 msedge.exe 83 PID 1944 wrote to memory of 636 1944 msedge.exe 83 PID 1944 wrote to memory of 636 1944 msedge.exe 83 PID 1944 wrote to memory of 636 1944 msedge.exe 83 PID 1944 wrote to memory of 636 1944 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a158d6928b0a20ad5ba65595c6bf5421_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffb2bd746f8,0x7ffb2bd74708,0x7ffb2bd747182⤵PID:680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,9410103542191168402,10926664170867873668,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 /prefetch:22⤵PID:2116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,9410103542191168402,10926664170867873668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,9410103542191168402,10926664170867873668,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:82⤵PID:636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,9410103542191168402,10926664170867873668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,9410103542191168402,10926664170867873668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,9410103542191168402,10926664170867873668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:82⤵PID:1196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,9410103542191168402,10926664170867873668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,9410103542191168402,10926664170867873668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:12⤵PID:1052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,9410103542191168402,10926664170867873668,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:12⤵PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,9410103542191168402,10926664170867873668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:12⤵PID:1912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,9410103542191168402,10926664170867873668,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:12⤵PID:1628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,9410103542191168402,10926664170867873668,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5876 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4668
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3656
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dabfafd78687947a9de64dd5b776d25f
SHA116084c74980dbad713f9d332091985808b436dea
SHA256c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
SHA512dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
-
Filesize
152B
MD5c39b3aa574c0c938c80eb263bb450311
SHA1f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA25666f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
SHA512eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
-
Filesize
292B
MD50b6c787e05bcb3392fe80eedd1b3a4e5
SHA1018101e469be1d6d80d10bee327400da9772977b
SHA2560ea0dc2d72e6b35b6473fd1bdc58e81c5e787f848cad8b1f1861021ab31aa107
SHA5120ca8b405c94fd0f946ea58de70de3edc90cb0678ea07d1777b516281ff4170ea398d00353594ac9ae445079d1d2dc7a928a808e1ca409eac3e0d2a06baf983bc
-
Filesize
6KB
MD50e69113a5971dc683613c07862ad1aa0
SHA1e8666a0968c1556edb3c96d02f08897421ca83ee
SHA256ae7c23636c2076fec459c81c8793d8b9b600b831e5b8b8e6a48675b83e8f7f35
SHA512b0130fa9475c198b10635a3f5fcddc3097d2c982f6983377035409cae4dddb1a287def4a5c6646e15277f485ddc6cdf43b67f25ff6b8458d4ff3f8ffca7cff5b
-
Filesize
6KB
MD54eb3077316c92758276785dbdf4b3cf3
SHA1d0672a6c09a506017af39edd2c0433d803c64927
SHA256216d20bdc171f0bba530ca8ca35408df19e3fbff515d51c0add5e9cd12b58039
SHA5121f7a75f0d46ecd35aa6f0e3411b9f84ff0f5915e6165d2d2105f3a5e9d5fc17c7bfb9f92f6c57baf68e9ebf2839464d18bbbc23355ea3c7ce7283dd2ed19851e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5f87a434bf8cca83dfe51bd053fc2b8a1
SHA102a6fcc6e23844dbce0e7ba0f7cefc6fbd856a9e
SHA256227c0c17049b6af89b8ba9d2d6161d1f7b374af7632f4d0df2e6223cd4488911
SHA51217b24c49ad70fd8622743cf14c66e465eb35fcf586ad1736a6cac9e66d92e47ef54bc6768937f2cf8bdb159a622130d0bcef3bb0063bc646cc029c73f89da9e4