Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 21:59
Static task
static1
Behavioral task
behavioral1
Sample
a6c610cedea5236fa992bf293c05aaeb_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
a6c610cedea5236fa992bf293c05aaeb_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a6c610cedea5236fa992bf293c05aaeb_JaffaCakes118.html
-
Size
27KB
-
MD5
a6c610cedea5236fa992bf293c05aaeb
-
SHA1
f1dec399d7b2c3e15cecf19402353845d9eed2da
-
SHA256
44d2b493a27508d231e9cec3dadce7a3684ce69a07df84c303e67939305f6acd
-
SHA512
bd1b15b01e3bb9f5b1dd9479bffd90f58e5528a2099066d3d6f25a6146d7b6bb0773fa2a07e33fac38e4c8c540dbf666a50a9e4be21729da8136bd1f34fa65ad
-
SSDEEP
384:ShoP/TAb+Fs69TXYL1dP3AHwl6CZcjRtQR6EJEND4KKK8xc4DEkdS66YBE8Feeed:Sy47BX69tQQEJEND6c4DEkdS66YBEl
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 940 msedge.exe 940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 2664 identity_helper.exe 2664 identity_helper.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1940 wrote to memory of 4968 1940 msedge.exe 82 PID 1940 wrote to memory of 4968 1940 msedge.exe 82 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 2864 1940 msedge.exe 83 PID 1940 wrote to memory of 940 1940 msedge.exe 84 PID 1940 wrote to memory of 940 1940 msedge.exe 84 PID 1940 wrote to memory of 3744 1940 msedge.exe 85 PID 1940 wrote to memory of 3744 1940 msedge.exe 85 PID 1940 wrote to memory of 3744 1940 msedge.exe 85 PID 1940 wrote to memory of 3744 1940 msedge.exe 85 PID 1940 wrote to memory of 3744 1940 msedge.exe 85 PID 1940 wrote to memory of 3744 1940 msedge.exe 85 PID 1940 wrote to memory of 3744 1940 msedge.exe 85 PID 1940 wrote to memory of 3744 1940 msedge.exe 85 PID 1940 wrote to memory of 3744 1940 msedge.exe 85 PID 1940 wrote to memory of 3744 1940 msedge.exe 85 PID 1940 wrote to memory of 3744 1940 msedge.exe 85 PID 1940 wrote to memory of 3744 1940 msedge.exe 85 PID 1940 wrote to memory of 3744 1940 msedge.exe 85 PID 1940 wrote to memory of 3744 1940 msedge.exe 85 PID 1940 wrote to memory of 3744 1940 msedge.exe 85 PID 1940 wrote to memory of 3744 1940 msedge.exe 85 PID 1940 wrote to memory of 3744 1940 msedge.exe 85 PID 1940 wrote to memory of 3744 1940 msedge.exe 85 PID 1940 wrote to memory of 3744 1940 msedge.exe 85 PID 1940 wrote to memory of 3744 1940 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a6c610cedea5236fa992bf293c05aaeb_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa3f246f8,0x7ffaa3f24708,0x7ffaa3f247182⤵PID:4968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,112020420640271836,677110883033584348,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:2864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,112020420640271836,677110883033584348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,112020420640271836,677110883033584348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:82⤵PID:3744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,112020420640271836,677110883033584348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:4492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,112020420640271836,677110883033584348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:2212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,112020420640271836,677110883033584348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:12⤵PID:3528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,112020420640271836,677110883033584348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:82⤵PID:4764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,112020420640271836,677110883033584348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,112020420640271836,677110883033584348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:12⤵PID:2680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,112020420640271836,677110883033584348,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:12⤵PID:1336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,112020420640271836,677110883033584348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:12⤵PID:3860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,112020420640271836,677110883033584348,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:12⤵PID:1084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,112020420640271836,677110883033584348,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1164
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2328
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2680
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c5abc082d9d9307e797b7e89a2f755f4
SHA154c442690a8727f1d3453b6452198d3ec4ec13df
SHA256a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
SHA512ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
-
Filesize
152B
MD5b4a74bc775caf3de7fc9cde3c30ce482
SHA1c6ed3161390e5493f71182a6cb98d51c9063775d
SHA256dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
SHA51255578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD569ddafa027ff50b6b8017834d282f0e5
SHA15ab1849dda988879e7ebf57d89c2aa27ff3ba2db
SHA2561c9cf1fb46ea18bf9c6c9300b244ccc010b9ae4727cd0cc08a81dfea31321018
SHA5121e63abe7641b4a45e5d379c527c8f12a9493d684e474ba1b075331a0104605cfe061edc0ac930b05397339c3cdfed8845749cd979c56f5c43303b897a46985d8
-
Filesize
1KB
MD5f444a523d363666a679bf3bcb44efcba
SHA10980a0f60e98ba94fa177e557ed398aea2839543
SHA256adcd8125b4a8d435981da1e07c292984f4e8e35e2738acf94e42eef6e41de95a
SHA512a0dde2d35824a1a725c4cb6b3f87d167e848b4a19d0a7c21cec7acb7020d38af195ee878d3e9d74c62ee906bf543159317f89f1e42b867523ffca8aa1f92e871
-
Filesize
1KB
MD51663904563230d5c91ff9f085ac6f876
SHA181c7752a25ee1db9d981c1949c15bc16efe14f61
SHA25647142d76f3653c65200d8fbaf078ed198134078bd2e6f603614739ec5faffa8b
SHA5128fb37ea38ecf1d4c933b056d38ed1ab6f61ffbe463836d73c93aaaaebef899277ff693951fdd02bab77c4a468e37fe4281c201e71d2397a47341d1bd6e10cc77
-
Filesize
6KB
MD59cfac58bd6a33d042c9ab7620c5683a2
SHA1851baf954705fb054a9647c7f7325b4a8fb88686
SHA256062332446a2b27c5d2709488a7ea982117ca3e0f317693c4c9f61b2fb8212e6a
SHA512132a1df1c80aa23c56868445ac6e357900cb0a4595722302566292a6a341dcbfb59fdd3e0021903e7b8a553568f429694845361c8f89bf6f2e39e9f27f3ee444
-
Filesize
6KB
MD5031bf9c0bdbeed83e9557200e3e990d7
SHA146ae01a9d604f51485dc18576342226337c8699e
SHA2567b77b1e22c9e2e0f48670f43d41f32134d4dccb053b1d4527c9607590dc59a43
SHA512663cdc9742c21b44aeea11b9e2f43c94f592a3415208a79710fed29c41f671f2d37b1df7eb3410f59aa13000ac56a9c993900cbe14215d22569eaf5ee0bad0ba
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD556db793570ccaa9b117fa5ef7642ca9b
SHA1aebafd15da679ccaa63a2f81c2cbb6e7f5869aeb
SHA256009fa11bba44f6fa02286cbe1dcd220fdbc8d592a75a052558699134c08f3b28
SHA512e52d6a474e410393211a6208d197e8a1a61e6e8edb74045086bad0ecc8a2962a65b53adee9880c9298e6501899f28c31d376f6280659a1ade16b4f7219d562df