Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 00:20
Static task
static1
Behavioral task
behavioral1
Sample
a31d6a50c88f74fbafd54b5cccd98b8d_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a31d6a50c88f74fbafd54b5cccd98b8d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a31d6a50c88f74fbafd54b5cccd98b8d_JaffaCakes118.html
-
Size
36KB
-
MD5
a31d6a50c88f74fbafd54b5cccd98b8d
-
SHA1
fd44590f222be084dfd1457e2254404f732ae2ae
-
SHA256
72f7c689e9efc1dd18249c86f61a471ba03e23bad7fcb89ddca1e28f0fa0aae2
-
SHA512
f30fd02f7482d6d4eb3301f4981543edb70a92682ae0fd275febb5aa9790e7556398b3d02d6d7e990101107f0b1a4324f80459f993ccc1a185b40d6ecdd0c75d
-
SSDEEP
768:zwx/MDTHK888hARUZPX3E1XnXrFLxNLlDNoPqkPTHlnkM3Gr6ThZOg6f9U56lLRU:Q/vbJxNVNufSM/P81K
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1820 msedge.exe 1820 msedge.exe 4068 msedge.exe 4068 msedge.exe 3888 identity_helper.exe 3888 identity_helper.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4068 wrote to memory of 5012 4068 msedge.exe 81 PID 4068 wrote to memory of 5012 4068 msedge.exe 81 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 2804 4068 msedge.exe 82 PID 4068 wrote to memory of 1820 4068 msedge.exe 83 PID 4068 wrote to memory of 1820 4068 msedge.exe 83 PID 4068 wrote to memory of 4900 4068 msedge.exe 84 PID 4068 wrote to memory of 4900 4068 msedge.exe 84 PID 4068 wrote to memory of 4900 4068 msedge.exe 84 PID 4068 wrote to memory of 4900 4068 msedge.exe 84 PID 4068 wrote to memory of 4900 4068 msedge.exe 84 PID 4068 wrote to memory of 4900 4068 msedge.exe 84 PID 4068 wrote to memory of 4900 4068 msedge.exe 84 PID 4068 wrote to memory of 4900 4068 msedge.exe 84 PID 4068 wrote to memory of 4900 4068 msedge.exe 84 PID 4068 wrote to memory of 4900 4068 msedge.exe 84 PID 4068 wrote to memory of 4900 4068 msedge.exe 84 PID 4068 wrote to memory of 4900 4068 msedge.exe 84 PID 4068 wrote to memory of 4900 4068 msedge.exe 84 PID 4068 wrote to memory of 4900 4068 msedge.exe 84 PID 4068 wrote to memory of 4900 4068 msedge.exe 84 PID 4068 wrote to memory of 4900 4068 msedge.exe 84 PID 4068 wrote to memory of 4900 4068 msedge.exe 84 PID 4068 wrote to memory of 4900 4068 msedge.exe 84 PID 4068 wrote to memory of 4900 4068 msedge.exe 84 PID 4068 wrote to memory of 4900 4068 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a31d6a50c88f74fbafd54b5cccd98b8d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd711f46f8,0x7ffd711f4708,0x7ffd711f47182⤵PID:5012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,9432334101255457530,7287961508585462625,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵PID:2804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,9432334101255457530,7287961508585462625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,9432334101255457530,7287961508585462625,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9432334101255457530,7287961508585462625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:4212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9432334101255457530,7287961508585462625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,9432334101255457530,7287961508585462625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:82⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,9432334101255457530,7287961508585462625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9432334101255457530,7287961508585462625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:12⤵PID:1328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9432334101255457530,7287961508585462625,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:12⤵PID:2444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9432334101255457530,7287961508585462625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9432334101255457530,7287961508585462625,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:12⤵PID:3140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,9432334101255457530,7287961508585462625,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5312 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4920
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2844
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
5KB
MD5a1dc2b6a5e66df5d93faafdaeef17865
SHA1ca8fd2b4610d821a7d7819cbc29db9b4f81bb2e7
SHA2567baffb43d76e761d8e0c4af806402b7c252c8952b2c1b8dcb5aafc7f19bd62b8
SHA51204a7c81406244369995fecf31d43943cea2c7001a40139626f0d92be504b0e54180285248a8f17cf3b2047fd31cd1f84dc4af4286b8029b160774c15573ed56b
-
Filesize
6KB
MD5d046a721eb617f81e205ed3f9906a13c
SHA18ea73755e7eae678737b8c0b0626cd7086f6cede
SHA256263496329101fb7f09452e847f7a55936cbebd3257ddf32446d19c4e160477ff
SHA512410568e92f471a9a0e8d31003d164698b45a72ba8fb6f6266d7fb8ffdbb7349af8496d5f99967f74e884ea2ec91a8409b10a18951f1bf01443a90492f6a2de97
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD5f8bbb7daabe49c311ea6b84f5f4891cb
SHA1ffeef57eea5d4a2abe14e65324e2dd670ee2404f
SHA256656b8f14f3b58397a21aa4364f3c14fc587020d40b4bb9658a290e0c86b692d1
SHA51280ff52ab029419fee8c9404449aeacc393c85f99410197281fe851d419b3a1654b7846edfacfecce36957746ca4072f2ff309459e68bb943e65195387576d4c8