Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 20:19
Static task
static1
Behavioral task
behavioral1
Sample
a22d3699aa2a2db05e21cd80c7b27906_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a22d3699aa2a2db05e21cd80c7b27906_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a22d3699aa2a2db05e21cd80c7b27906_JaffaCakes118.html
-
Size
36KB
-
MD5
a22d3699aa2a2db05e21cd80c7b27906
-
SHA1
403551027d283085718d42664693f2a24a8f4838
-
SHA256
dc3053dda98f69263ea8a3214015b841e11ef235269f1631f6a3fbbb1d15ec51
-
SHA512
1b95cda0b918ff659a861403fbf7aef991ba83d089324ba9c3232b5f77cb453c0d7e3c770d3004dc2cd8e12913a56467f5dc2938d9e5ce4af8214f6a3f11eaec
-
SSDEEP
768:zwx/MDTH1d88hARnZPX2E1XnXrFLxNLlDNoPqkPTHlnkM3Gr6T/uJxF6lJtxU6l7:Q//bJxNV4u0Sx/x8wK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 984 msedge.exe 984 msedge.exe 1956 msedge.exe 1956 msedge.exe 1616 identity_helper.exe 1616 identity_helper.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1956 wrote to memory of 3600 1956 msedge.exe 80 PID 1956 wrote to memory of 3600 1956 msedge.exe 80 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 3652 1956 msedge.exe 83 PID 1956 wrote to memory of 984 1956 msedge.exe 84 PID 1956 wrote to memory of 984 1956 msedge.exe 84 PID 1956 wrote to memory of 264 1956 msedge.exe 85 PID 1956 wrote to memory of 264 1956 msedge.exe 85 PID 1956 wrote to memory of 264 1956 msedge.exe 85 PID 1956 wrote to memory of 264 1956 msedge.exe 85 PID 1956 wrote to memory of 264 1956 msedge.exe 85 PID 1956 wrote to memory of 264 1956 msedge.exe 85 PID 1956 wrote to memory of 264 1956 msedge.exe 85 PID 1956 wrote to memory of 264 1956 msedge.exe 85 PID 1956 wrote to memory of 264 1956 msedge.exe 85 PID 1956 wrote to memory of 264 1956 msedge.exe 85 PID 1956 wrote to memory of 264 1956 msedge.exe 85 PID 1956 wrote to memory of 264 1956 msedge.exe 85 PID 1956 wrote to memory of 264 1956 msedge.exe 85 PID 1956 wrote to memory of 264 1956 msedge.exe 85 PID 1956 wrote to memory of 264 1956 msedge.exe 85 PID 1956 wrote to memory of 264 1956 msedge.exe 85 PID 1956 wrote to memory of 264 1956 msedge.exe 85 PID 1956 wrote to memory of 264 1956 msedge.exe 85 PID 1956 wrote to memory of 264 1956 msedge.exe 85 PID 1956 wrote to memory of 264 1956 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a22d3699aa2a2db05e21cd80c7b27906_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81a3346f8,0x7ff81a334708,0x7ff81a3347182⤵PID:3600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,10413044904008258990,9484743297398191178,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:22⤵PID:3652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,10413044904008258990,9484743297398191178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,10413044904008258990,9484743297398191178,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:82⤵PID:264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,10413044904008258990,9484743297398191178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:4616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,10413044904008258990,9484743297398191178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,10413044904008258990,9484743297398191178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:82⤵PID:2336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,10413044904008258990,9484743297398191178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,10413044904008258990,9484743297398191178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:12⤵PID:760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,10413044904008258990,9484743297398191178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:12⤵PID:4256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,10413044904008258990,9484743297398191178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:12⤵PID:4864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,10413044904008258990,9484743297398191178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:12⤵PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,10413044904008258990,9484743297398191178,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1544
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2228
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5477462b6ad8eaaf8d38f5e3a4daf17b0
SHA186174e670c44767c08a39cc2a53c09c318326201
SHA256e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
SHA512a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
-
Filesize
152B
MD5b704c9ca0493bd4548ac9c69dc4a4f27
SHA1a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA2562ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
SHA51269c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
-
Filesize
614B
MD5b117e4ddbb37cf4d54b55f7a44c52210
SHA1b5071fd7b4aa76fd93216aaec226d0f9a316c6c7
SHA25687cc12e1d6d5700ef34caeeb607d1de71b065411b5c139908e748efec7b6fa89
SHA512345b745caad911c50007c75820ebaa205e1db29d2e5695c6789e357190832d8dd52ac52b1aba477475b68ed36a299070c303782f08654718907fd174c7f6f74d
-
Filesize
6KB
MD5cac40f53a4fd35c155c5a6a369c2fc61
SHA127ceff3127e37403ac009a6455d5ebd40f261bfa
SHA256eae3160aa61e2801bcff95f20e8e4af7e3532d6bb35d617d948f0628d2981666
SHA512ec2a18f348bc3bdf70e5236f85bec3534eb161f8014275d3d471b62964f299e9759856e097be0619a6d4eaca9c8c0377325ae2f8b8f15ada9ed8ae503c0b40ec
-
Filesize
6KB
MD5c8a903001ba3caf05fa47f41c5e28d8d
SHA1a0c29b1c1ddf6aa49c1a9dd22cdbabeddce209a6
SHA256d9dad059a51d076fbe1d49781a67e2d8a524a8cf18fec9df6b0ab6b061727a5f
SHA512a54da90fba091a6b4d783b872aca0757a0f3e06937c7f1f1312e98a64e0a1d19892e168aa2943287baa2e3b6014d9892cfa8831b418a7b28479e2c4ed9d6d7e3
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5408f555556b4f7b7b872011e319c1e11
SHA156c2f3ed18c388cacbccca0dc37ce2942f81acd9
SHA2563d6258f1447b15282de7bdf029570e422f36415b01fc5ff0fccb7f8ba795c5d2
SHA5122243ebb3bd3aab889fd880f1aa825ec17c50a17a385c7a5f5bc5c5d9e4a8e1ef224556c1a98635a643e95cdd526e5c1d17fa8ac602d16fbb907be25b52b08575