Analysis
-
max time kernel
145s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 20:19
Static task
static1
Behavioral task
behavioral1
Sample
a22d30df9b512720b8088ee2ffaece64_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a22d30df9b512720b8088ee2ffaece64_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a22d30df9b512720b8088ee2ffaece64_JaffaCakes118.html
-
Size
139KB
-
MD5
a22d30df9b512720b8088ee2ffaece64
-
SHA1
f6a6d2665221453bdd2e6a7da62852f33f838b65
-
SHA256
ae2ef8419e29972c193a085b3dbc5668023d1126bb5ff809ae6db567b9c139ba
-
SHA512
b33ef4969d297a8c1bae3bf9c9b62f861cb4b1f3571a737a22125c83207839d24ef6a7cdc548288a22c21c16342a6db7ef4860574bdf4dc324dc355e8cb4d067
-
SSDEEP
1536:S8zrBHlftyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:S8ZyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 668 msedge.exe 668 msedge.exe 4164 msedge.exe 4164 msedge.exe 1340 identity_helper.exe 1340 identity_helper.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4164 wrote to memory of 3432 4164 msedge.exe 82 PID 4164 wrote to memory of 3432 4164 msedge.exe 82 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 1284 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 84 PID 4164 wrote to memory of 668 4164 msedge.exe 84 PID 4164 wrote to memory of 1400 4164 msedge.exe 85 PID 4164 wrote to memory of 1400 4164 msedge.exe 85 PID 4164 wrote to memory of 1400 4164 msedge.exe 85 PID 4164 wrote to memory of 1400 4164 msedge.exe 85 PID 4164 wrote to memory of 1400 4164 msedge.exe 85 PID 4164 wrote to memory of 1400 4164 msedge.exe 85 PID 4164 wrote to memory of 1400 4164 msedge.exe 85 PID 4164 wrote to memory of 1400 4164 msedge.exe 85 PID 4164 wrote to memory of 1400 4164 msedge.exe 85 PID 4164 wrote to memory of 1400 4164 msedge.exe 85 PID 4164 wrote to memory of 1400 4164 msedge.exe 85 PID 4164 wrote to memory of 1400 4164 msedge.exe 85 PID 4164 wrote to memory of 1400 4164 msedge.exe 85 PID 4164 wrote to memory of 1400 4164 msedge.exe 85 PID 4164 wrote to memory of 1400 4164 msedge.exe 85 PID 4164 wrote to memory of 1400 4164 msedge.exe 85 PID 4164 wrote to memory of 1400 4164 msedge.exe 85 PID 4164 wrote to memory of 1400 4164 msedge.exe 85 PID 4164 wrote to memory of 1400 4164 msedge.exe 85 PID 4164 wrote to memory of 1400 4164 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a22d30df9b512720b8088ee2ffaece64_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff825a646f8,0x7ff825a64708,0x7ff825a647182⤵PID:3432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,8938914036022375544,10041197212211139499,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:1284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,8938914036022375544,10041197212211139499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,8938914036022375544,10041197212211139499,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:82⤵PID:1400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8938914036022375544,10041197212211139499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8938914036022375544,10041197212211139499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:4084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,8938914036022375544,10041197212211139499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4340 /prefetch:82⤵PID:4384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,8938914036022375544,10041197212211139499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4340 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8938914036022375544,10041197212211139499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:12⤵PID:3212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8938914036022375544,10041197212211139499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:12⤵PID:3296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8938914036022375544,10041197212211139499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:12⤵PID:1392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8938914036022375544,10041197212211139499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:12⤵PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,8938914036022375544,10041197212211139499,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4380 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3788
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3568
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
5KB
MD5814a35d9d404942d2ab74c69862bc5cf
SHA128bc08ea334986add5a6eb269d88aeb86e3eadcf
SHA25656b6cb30dc2bbd900eae4197a7f1f30958ab7401227aa25e2aa43d3d48eeef36
SHA5121136c33e5201b905efa8e83912f71384f6c8480a81aaf06d58d1a580d8e2b036a6a8e23f6ca5140d101c1e00b877970645deedd8ebc62eeb2385dc1e069eb67a
-
Filesize
5KB
MD58ad33532faf4ae714f42c8b4345c33b0
SHA1d2c4fcd54ef10c8c6ebe65c650a538905bf2572d
SHA256601651e52d10fc0d4d32ecb8a01db257c5efcfddce4d0a31d9711c0cc605ee99
SHA51271a19c0953be0ec9e0175ae50eae6b909b9b2eaba8e187f0c577123dd1b61dacb7428e82d1715c9283e5f67c9ad1fac57003c3e9156c12084a71ddae74bafaf9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD5330d89c2fbe2969b739a321e22e0074e
SHA142d0710028c40cc722a7623b3560d7115a1499e5
SHA2569e3c91df48f5c2df7b27e6e245a227ef7dfb484f1e5043a2117547b9907ba232
SHA5124e99fc6f867cd27099bc48204cb6fd5b86c39b52f37cc5ad11d86469157e87c2a46841f5278f9c18f20691934fa1d6f96759c1eea45e2761ea5a9af08f58eab5