Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 21:33
Static task
static1
Behavioral task
behavioral1
Sample
a6ab31a9ccdd1c9f1ea265a0129fb2bb_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a6ab31a9ccdd1c9f1ea265a0129fb2bb_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a6ab31a9ccdd1c9f1ea265a0129fb2bb_JaffaCakes118.html
-
Size
35KB
-
MD5
a6ab31a9ccdd1c9f1ea265a0129fb2bb
-
SHA1
73034fd1da627afc5e8f9c4c31bf1564f6a1bb75
-
SHA256
658ba23e2c2de2a99e7447f9ce1b4203a5ea7bfa4224c17874a89526e2d4fa8b
-
SHA512
af7e7af383ba9a8b747c101929db88557c69f305fdc1d39c9f6ea4601b480cbd3e42cc2acb8df12189fe89feaf219ec849f853b05f1080fed627da0b9889f205
-
SSDEEP
768:ESFQW81D4RA+vEOjz6rdG2Gil54RZfPGnf3Gu34azi6781DdRA4vEOjq6h8aRlRV:VFQW81D4RA+vEOjz6raAhIaGC81DdRAY
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1408 msedge.exe 1408 msedge.exe 4984 msedge.exe 4984 msedge.exe 1476 identity_helper.exe 1476 identity_helper.exe 2692 msedge.exe 2692 msedge.exe 2692 msedge.exe 2692 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe 4984 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4984 wrote to memory of 3528 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 3528 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 2336 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 1408 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 1408 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe PID 4984 wrote to memory of 4704 4984 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a6ab31a9ccdd1c9f1ea265a0129fb2bb_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97ed846f8,0x7ff97ed84708,0x7ff97ed847182⤵PID:3528
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10701036493611977723,18159221239825359137,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:2336
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,10701036493611977723,18159221239825359137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1408 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,10701036493611977723,18159221239825359137,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵PID:4704
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10701036493611977723,18159221239825359137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:2352
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10701036493611977723,18159221239825359137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2116 /prefetch:12⤵PID:3604
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10701036493611977723,18159221239825359137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:82⤵PID:1628
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10701036493611977723,18159221239825359137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1476 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10701036493611977723,18159221239825359137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:12⤵PID:3960
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10701036493611977723,18159221239825359137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:12⤵PID:4492
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10701036493611977723,18159221239825359137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:12⤵PID:2892
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10701036493611977723,18159221239825359137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:12⤵PID:4048
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10701036493611977723,18159221239825359137,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2692
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1548
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD581e892ca5c5683efdf9135fe0f2adb15
SHA139159b30226d98a465ece1da28dc87088b20ecad
SHA256830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
SHA512c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
-
Filesize
152B
MD556067634f68231081c4bd5bdbfcc202f
SHA15582776da6ffc75bb0973840fc3d15598bc09eb1
SHA2568c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
SHA512c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
-
Filesize
572B
MD5cf67193c36d02c91e4649756083a1317
SHA1f0951da73837b6b47a4a9c8c2f88a144575a511d
SHA256799ca419d23a94443c6fd2e95a290b840325af9bfd7a961e4f82dd4065fb9038
SHA5128dd47809a7696aa6ca6a342924ca4ba50168c1430ef1af8db12b6126644a17405da301dd2694028795da66c0190bd169a2ec66a267428bf5ae05862554d89286
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
6KB
MD5458bd7cd546bcad4960a6f92c73807b8
SHA1c15779e2cef805f0816d484ac974231966969934
SHA25648966408b0a5dd86fbf6669be8b53eff8e28c82af0d959e4756fa44d73ccf8cb
SHA512bd36795148393b1fe6e06fea5ef2f4ef3a9ce005a48a2fe15dd8f8542f6ae5beedd975591ea0fb8b8648ce8e0b94bcc19047f207af4d8fe77e1d147f1e5029fb
-
Filesize
6KB
MD54d661ae0f0e8d61576d3a9405a386e93
SHA13ff1ba1e62e9d76a0752a50c60e2acb06c3155bc
SHA2560fb3bd52e5288146f2f6f35da18f6a11eaeaf604ad92f080c1aa9484b3a0f8dd
SHA512436590b18633d4fe3113f0eebf20aa487582a66218eff3ab0fa2af776f5bc3f9ef420856ddac45d0ba86f32a33a2e6c27c9cfcd5920b0abc54b27fb8e634aa1b
-
Filesize
6KB
MD5083f2e1e4fc62a03e85b6fdaeaec052d
SHA1dd0c9455fabcae329b0dffc190b4f999b98d3bf4
SHA256f1331be61fc2d91548da1970914a251f0c2a143680c021cc9460f408f508f803
SHA512c74cef8dd86b4cad49214a7544f42fb82f7a629e2badd4c6e783e6203c71f75954100429aa4ac81ee95606f260999b7ab22a8407496d07e4de053b6ee2fa581d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5e181c2486e37ad8cac3770ea847e2d5e
SHA16e8c88bf895a27df003f0a6b74abdebdd8874db9
SHA256f44eb2750b1e2abdbf6e0474ea192583baa5bc25d46de6ef37683dad22ef7798
SHA512a345287c51b7841a9bb4b9442c597e8a41d337bcda2bb7176da035a67100a711e693c3bf9f52142fee6eb2cbf3da5a7c34b4bd8f7adb550fad16c2e4284fc89e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e