Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 23:50
Static task
static1
Behavioral task
behavioral1
Sample
a72e340a1cf428007fde84991f32a963_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a72e340a1cf428007fde84991f32a963_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a72e340a1cf428007fde84991f32a963_JaffaCakes118.html
-
Size
218KB
-
MD5
a72e340a1cf428007fde84991f32a963
-
SHA1
86ac9dd030181b99de9ea3ea076794903f088d8e
-
SHA256
ed0ec5d271e9c095ee5d4eb027d42b6f930f1ae82fdb9032ae339c41e52fb1f7
-
SHA512
9f6157c486bf796f95ecda5560db2446c0f950733875f81e460f9ade5a9e092c067367f7c2828cbb19a7d597374fad2a2050ff70b6db6370aea9907512cb7948
-
SSDEEP
3072:SR6O66b+6lpRyfkMY+BES09JXAnyrZalI+YQ:SRTJb+uisMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 692 msedge.exe 692 msedge.exe 2524 msedge.exe 2524 msedge.exe 3808 msedge.exe 3808 msedge.exe 3808 msedge.exe 3808 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2524 msedge.exe 2524 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2584 2524 msedge.exe 81 PID 2524 wrote to memory of 2584 2524 msedge.exe 81 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 2444 2524 msedge.exe 83 PID 2524 wrote to memory of 692 2524 msedge.exe 84 PID 2524 wrote to memory of 692 2524 msedge.exe 84 PID 2524 wrote to memory of 1232 2524 msedge.exe 85 PID 2524 wrote to memory of 1232 2524 msedge.exe 85 PID 2524 wrote to memory of 1232 2524 msedge.exe 85 PID 2524 wrote to memory of 1232 2524 msedge.exe 85 PID 2524 wrote to memory of 1232 2524 msedge.exe 85 PID 2524 wrote to memory of 1232 2524 msedge.exe 85 PID 2524 wrote to memory of 1232 2524 msedge.exe 85 PID 2524 wrote to memory of 1232 2524 msedge.exe 85 PID 2524 wrote to memory of 1232 2524 msedge.exe 85 PID 2524 wrote to memory of 1232 2524 msedge.exe 85 PID 2524 wrote to memory of 1232 2524 msedge.exe 85 PID 2524 wrote to memory of 1232 2524 msedge.exe 85 PID 2524 wrote to memory of 1232 2524 msedge.exe 85 PID 2524 wrote to memory of 1232 2524 msedge.exe 85 PID 2524 wrote to memory of 1232 2524 msedge.exe 85 PID 2524 wrote to memory of 1232 2524 msedge.exe 85 PID 2524 wrote to memory of 1232 2524 msedge.exe 85 PID 2524 wrote to memory of 1232 2524 msedge.exe 85 PID 2524 wrote to memory of 1232 2524 msedge.exe 85 PID 2524 wrote to memory of 1232 2524 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a72e340a1cf428007fde84991f32a963_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb16d946f8,0x7ffb16d94708,0x7ffb16d947182⤵PID:2584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,6991571643658928762,4929260898686032021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:2444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,6991571643658928762,4929260898686032021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,6991571643658928762,4929260898686032021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:82⤵PID:1232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6991571643658928762,4929260898686032021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:3952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,6991571643658928762,4929260898686032021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:2000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,6991571643658928762,4929260898686032021,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2948 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3808
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2120
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dabfafd78687947a9de64dd5b776d25f
SHA116084c74980dbad713f9d332091985808b436dea
SHA256c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
SHA512dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
-
Filesize
152B
MD5c39b3aa574c0c938c80eb263bb450311
SHA1f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA25666f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
SHA512eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
-
Filesize
6KB
MD5ccde3917de1c85d705ad8bbf54672b15
SHA1c34ba95ab9fdb77c62365397b6ca021d44172bf8
SHA2562f2d9247f7a6f6931df699028322f093d412bc3e9a8733f10c29a53f5639d84e
SHA51285e10d3029cb084300e29c63ffbab8e9f50b6403de9fbc78c4defa1e9302ef9b90213321b3a6fac22a988bce05041f800c1eff69fc7381e425b718ff43d8f79d
-
Filesize
6KB
MD567b2ae42146c5a5fdc79cb7c1f1e29cb
SHA160876df0d69f217c677090388ffb77d565b1ac9d
SHA25634e26f2078bfec0c328da5105664ebd5334a723f72e5c8921b307e57b44b4048
SHA5124e2bac90d81e6ba19929112632be2ed6a8a4f0a6d91f496c515efda8694a39616e4638fb57a71edf18d384f8d0eb9bec9331fb95248db4f40ce6717a508255c4
-
Filesize
11KB
MD5bb4f226cfde51ffb125b94c3b9b8154f
SHA1efb35ced0ef3b566beb5f825ea0df2168e159de0
SHA2560a937051b4389a0a6bd4642461edd7a3003a38d2873dcc2c9e57fc02a105aeef
SHA512d58494c092996feb15a9395ee7508b9b3f75b41a8f0a2da89a4ef5645cd6e7c53c9f8d2c9cec751e611fb47f68bbc007f184706e3ebc9302a2513e58c272f083