Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 18:43
Static task
static1
Behavioral task
behavioral1
Sample
a1cd5a7820c3ffcc2578347b28271beb_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a1cd5a7820c3ffcc2578347b28271beb_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a1cd5a7820c3ffcc2578347b28271beb_JaffaCakes118.html
-
Size
252KB
-
MD5
a1cd5a7820c3ffcc2578347b28271beb
-
SHA1
8832262cd8370dfce92bfab30572bacebda0e0a5
-
SHA256
685416e7987b1533800241777b1f284b8be7e827e103c6b5524391a0d7bd9994
-
SHA512
4bbca0214bc8f38e96c1d570b9a9c16422937f31ebac8a936891820b015636e3e26eaabd61c12fe8d7af91f2c8fe916b6b5a3a5f7afc2416cb17215cc22c2d73
-
SSDEEP
6144:k9Y+nItrPM6yHkMiha/yiFY2I7d+u+DAPvbU:k9Y+nItrPM6yd1FbH
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3712 msedge.exe 3712 msedge.exe 1112 msedge.exe 1112 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1112 wrote to memory of 3648 1112 msedge.exe 81 PID 1112 wrote to memory of 3648 1112 msedge.exe 81 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 5104 1112 msedge.exe 82 PID 1112 wrote to memory of 3712 1112 msedge.exe 83 PID 1112 wrote to memory of 3712 1112 msedge.exe 83 PID 1112 wrote to memory of 3060 1112 msedge.exe 84 PID 1112 wrote to memory of 3060 1112 msedge.exe 84 PID 1112 wrote to memory of 3060 1112 msedge.exe 84 PID 1112 wrote to memory of 3060 1112 msedge.exe 84 PID 1112 wrote to memory of 3060 1112 msedge.exe 84 PID 1112 wrote to memory of 3060 1112 msedge.exe 84 PID 1112 wrote to memory of 3060 1112 msedge.exe 84 PID 1112 wrote to memory of 3060 1112 msedge.exe 84 PID 1112 wrote to memory of 3060 1112 msedge.exe 84 PID 1112 wrote to memory of 3060 1112 msedge.exe 84 PID 1112 wrote to memory of 3060 1112 msedge.exe 84 PID 1112 wrote to memory of 3060 1112 msedge.exe 84 PID 1112 wrote to memory of 3060 1112 msedge.exe 84 PID 1112 wrote to memory of 3060 1112 msedge.exe 84 PID 1112 wrote to memory of 3060 1112 msedge.exe 84 PID 1112 wrote to memory of 3060 1112 msedge.exe 84 PID 1112 wrote to memory of 3060 1112 msedge.exe 84 PID 1112 wrote to memory of 3060 1112 msedge.exe 84 PID 1112 wrote to memory of 3060 1112 msedge.exe 84 PID 1112 wrote to memory of 3060 1112 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a1cd5a7820c3ffcc2578347b28271beb_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1a2246f8,0x7ffd1a224708,0x7ffd1a2247182⤵PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11158374496453254781,3775126724814083430,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:22⤵PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,11158374496453254781,3775126724814083430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,11158374496453254781,3775126724814083430,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:82⤵PID:3060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11158374496453254781,3775126724814083430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:2804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11158374496453254781,3775126724814083430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:4440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11158374496453254781,3775126724814083430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:12⤵PID:2780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11158374496453254781,3775126724814083430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1732 /prefetch:12⤵PID:1232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11158374496453254781,3775126724814083430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:12⤵PID:4968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11158374496453254781,3775126724814083430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:12⤵PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11158374496453254781,3775126724814083430,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3032
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2748
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD581e892ca5c5683efdf9135fe0f2adb15
SHA139159b30226d98a465ece1da28dc87088b20ecad
SHA256830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
SHA512c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
-
Filesize
152B
MD556067634f68231081c4bd5bdbfcc202f
SHA15582776da6ffc75bb0973840fc3d15598bc09eb1
SHA2568c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
SHA512c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD574f29d8e8967bffb6767807997fadc3b
SHA1c64fcd0515eae8f9982d57a984c23cabff1cc508
SHA256cd1e8099865eed348b54bde586bfe9e48bf018595688fb5b45f0cc8d1756409d
SHA5127b202286cebb4aeb303193172c472559756040afbe640bacb8866233e2c824658704729fbb2b71de04594091215d9f4c7be086a17a0018361716062683cc8779
-
Filesize
1KB
MD5ad0251572a4a33be3d6b514f99c98f49
SHA1c037d59fa5a8d36f7ae03afe36d15f4c7a8bc02c
SHA256dd010f26e2b2b0ebe7985f67e696203fc77b044e1721b26be3582982e8540e46
SHA512dc0c8637729ad52e89fd1a5e72322a00cfa4c061667bb730071269cc1c62da07a3082905b69974f909324199ee7ffe47e2d948bd33e187603c1860ed9e0326b4
-
Filesize
2KB
MD5c47c5c4f6b9109369474c62eb17aea84
SHA1b7a5d32aa480b2fe4ba806126a1ea4ae570e0347
SHA256798c483acbe4c7575d231b6b39638983f8e558604b78557d789bc3e35e2f746c
SHA512649b59ab9e44c4c2b9fbffe8a58c8b9666e3e21d8a4ed25507d2d17e1ff0f1c193931622ba467de4f4534fc31aa3b4e85874400381380f50fe557ea1ccb4b0d2
-
Filesize
6KB
MD5e96414adc040123cb1539d1fd6d94ca0
SHA130e954bc48da3fb3dec109a08dd12809a1074828
SHA256eef22e9ee72efd12f7adc0856a2f115ac2ad231629fd681a84aaad65b3c607b2
SHA512ba11591e5cc1a2ab395a62236bbed832a82c2b823f57726c0fc2d26f9193de494a8de988c4743bb35d2d32790b55992c81334fe454b119c62946c778f103e757
-
Filesize
7KB
MD513b71b0814d12054103a8fd47c5f6a94
SHA13b6d7a6195b6ac7f344878f3bfcee3e190df88c4
SHA25678c4b787e46c33891f460e58013d81c15dbfc670a8770a53d8520ca339b3864a
SHA512da2d4f830698316e901d258746338d36d397f5ce19e9594a9f3b3074e46027501cd18759890e95e1d13ccc4e829baea74f396a0ab244bc5bc36b0446666c62cb
-
Filesize
6KB
MD525996fca6b11b858485da2eb3266a048
SHA126beb466f3522856c376e5a028283b17535368e8
SHA256c9757a31a3583a913b8414531ec2be0892498243323c8ccd87534afe5a7fa0c5
SHA512e333f3cb80eb746611df031a3881d46d6dc5225cd1ad9a0913662136258e317a6abfed34c3ae418068d96b5a629f69be9cbd9b3597d5f4b66a9253c5615b4eed
-
Filesize
11KB
MD571e20ac114cb1833bd2839556a578c97
SHA1bcf188f154100a4fb94c651b45b495d547396350
SHA256d4c99843a4051d7c9f57367e17e5cd5867e5febd3fcdc549b73097323141583c
SHA51214f909a3ca1efd008e600fdf1fc2ef2e59a0c07a71a14e20b126a1dcb031446ce40054711a3311e1ae3282c3e59b2bd2b359fe2d66c95bc15f394227dccfdc51