Analysis
-
max time kernel
145s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 01:11
Static task
static1
Behavioral task
behavioral1
Sample
a34ee0c632ba247472d3b435a78dd0bb_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a34ee0c632ba247472d3b435a78dd0bb_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a34ee0c632ba247472d3b435a78dd0bb_JaffaCakes118.html
-
Size
112KB
-
MD5
a34ee0c632ba247472d3b435a78dd0bb
-
SHA1
8d91b686332efbe79e674b447e4b671779866b7f
-
SHA256
889e5a528be6fe9862c37952f05439f6cef2a0b21e8992c2b1fb0ffbc9bb9271
-
SHA512
cb3f068c621e3f02f76f80e7f8c2a873b057036327c8f3aa8f482d89292dcc95ebac2000aa7a98f347f545d7b2a2a2acb82240c26e807c69e2500ef2cc6b94dd
-
SSDEEP
1536:SUIeK/yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:SFyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1652 msedge.exe 1652 msedge.exe 4936 msedge.exe 4936 msedge.exe 2700 identity_helper.exe 2700 identity_helper.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe 4980 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4936 wrote to memory of 3548 4936 msedge.exe 80 PID 4936 wrote to memory of 3548 4936 msedge.exe 80 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 2092 4936 msedge.exe 81 PID 4936 wrote to memory of 1652 4936 msedge.exe 82 PID 4936 wrote to memory of 1652 4936 msedge.exe 82 PID 4936 wrote to memory of 2524 4936 msedge.exe 83 PID 4936 wrote to memory of 2524 4936 msedge.exe 83 PID 4936 wrote to memory of 2524 4936 msedge.exe 83 PID 4936 wrote to memory of 2524 4936 msedge.exe 83 PID 4936 wrote to memory of 2524 4936 msedge.exe 83 PID 4936 wrote to memory of 2524 4936 msedge.exe 83 PID 4936 wrote to memory of 2524 4936 msedge.exe 83 PID 4936 wrote to memory of 2524 4936 msedge.exe 83 PID 4936 wrote to memory of 2524 4936 msedge.exe 83 PID 4936 wrote to memory of 2524 4936 msedge.exe 83 PID 4936 wrote to memory of 2524 4936 msedge.exe 83 PID 4936 wrote to memory of 2524 4936 msedge.exe 83 PID 4936 wrote to memory of 2524 4936 msedge.exe 83 PID 4936 wrote to memory of 2524 4936 msedge.exe 83 PID 4936 wrote to memory of 2524 4936 msedge.exe 83 PID 4936 wrote to memory of 2524 4936 msedge.exe 83 PID 4936 wrote to memory of 2524 4936 msedge.exe 83 PID 4936 wrote to memory of 2524 4936 msedge.exe 83 PID 4936 wrote to memory of 2524 4936 msedge.exe 83 PID 4936 wrote to memory of 2524 4936 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a34ee0c632ba247472d3b435a78dd0bb_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd168946f8,0x7ffd16894708,0x7ffd168947182⤵PID:3548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,9989194336450795452,3603453181581521860,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:2092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,9989194336450795452,3603453181581521860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,9989194336450795452,3603453181581521860,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:82⤵PID:2524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9989194336450795452,3603453181581521860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:4560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9989194336450795452,3603453181581521860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:2536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,9989194336450795452,3603453181581521860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4508 /prefetch:82⤵PID:3436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,9989194336450795452,3603453181581521860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4508 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9989194336450795452,3603453181581521860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:12⤵PID:1656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9989194336450795452,3603453181581521860,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:12⤵PID:3184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9989194336450795452,3603453181581521860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:12⤵PID:2624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9989194336450795452,3603453181581521860,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:12⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,9989194336450795452,3603453181581521860,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2688 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4980
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1464
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2324
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
5KB
MD516f48340c9a2273708f199d5be74febd
SHA19c750cfb3f369fb6899fc51033b5374109ff7160
SHA256db3cbe75521cb8c58dcd8f5a1e736ab4ebaf828878d92dae78169252f61aaffc
SHA512b415ba0980db92684bc03738da0dd12c42a7ad9ac32e2d75c3c0e4d4f6451c4e921a5f7009a6a1d5a529fce5dc2347ff53a222a97581b28b787a3a820d27ba90
-
Filesize
6KB
MD5f090c886fecebd918749a94ad8a7a6de
SHA11f6c02f1b9829d16474de5bd5bef15732c7c4ea5
SHA256f2bc9c1d7714ea9a254371f4a44b5f64b3e97992dcd1679f408a01ac5b08c62d
SHA5121f5a37568c522d45ebcf07f7da183731a423c8f99abbb12b5b0176a1fc7ab99e4bc7c7008f879550411b880b99e046eed25bbe19b2478ccbcfb29823385e0ed6
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD53910e8cef3ac597ff8e8f3b06f2772c1
SHA1b35fd59bad61510a76bcba1b3671cb83e494076a
SHA256fd9f775d22b74f5526f4f488abf4f13f5c27d2471d976af141dbead60f6790c5
SHA5123278d346c7c954a88fc58e0c4a1767e3a9c70a6c84a201ba036f144461073aa3d0d840fbd9abbbf6077675e02168fc80a7979d81882e51a2c571a5541d3e762f