Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 01:18
Static task
static1
Behavioral task
behavioral1
Sample
a354eb23d5d04b64c2f216894eb809cd_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a354eb23d5d04b64c2f216894eb809cd_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a354eb23d5d04b64c2f216894eb809cd_JaffaCakes118.html
-
Size
67KB
-
MD5
a354eb23d5d04b64c2f216894eb809cd
-
SHA1
e95d6b7ce6aa3e098e1badad61db659edc6bbba3
-
SHA256
291c1915def32854f615d79e4ed49fc75ed720c20e7876930caae8f5b8791d32
-
SHA512
33d8ff4f7f4421cb2cad143afa63af430e77360959e666a5dc107845b90d9190cc071f69b72494929bf8c74d69dc105faa74b9bac28c03961020d4784ca7cee4
-
SSDEEP
768:JiKgcMsSZ8tN99OIsVHOoTyfQCZkoTnMdtbBnfBgN8/oygcR/QFVG8c//IjkK5nM:J4WsTePec0tbrga6cuNnzIjv
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3832 msedge.exe 3832 msedge.exe 1784 msedge.exe 1784 msedge.exe 4188 identity_helper.exe 4188 identity_helper.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1784 wrote to memory of 4192 1784 msedge.exe 81 PID 1784 wrote to memory of 4192 1784 msedge.exe 81 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3684 1784 msedge.exe 82 PID 1784 wrote to memory of 3832 1784 msedge.exe 83 PID 1784 wrote to memory of 3832 1784 msedge.exe 83 PID 1784 wrote to memory of 4328 1784 msedge.exe 84 PID 1784 wrote to memory of 4328 1784 msedge.exe 84 PID 1784 wrote to memory of 4328 1784 msedge.exe 84 PID 1784 wrote to memory of 4328 1784 msedge.exe 84 PID 1784 wrote to memory of 4328 1784 msedge.exe 84 PID 1784 wrote to memory of 4328 1784 msedge.exe 84 PID 1784 wrote to memory of 4328 1784 msedge.exe 84 PID 1784 wrote to memory of 4328 1784 msedge.exe 84 PID 1784 wrote to memory of 4328 1784 msedge.exe 84 PID 1784 wrote to memory of 4328 1784 msedge.exe 84 PID 1784 wrote to memory of 4328 1784 msedge.exe 84 PID 1784 wrote to memory of 4328 1784 msedge.exe 84 PID 1784 wrote to memory of 4328 1784 msedge.exe 84 PID 1784 wrote to memory of 4328 1784 msedge.exe 84 PID 1784 wrote to memory of 4328 1784 msedge.exe 84 PID 1784 wrote to memory of 4328 1784 msedge.exe 84 PID 1784 wrote to memory of 4328 1784 msedge.exe 84 PID 1784 wrote to memory of 4328 1784 msedge.exe 84 PID 1784 wrote to memory of 4328 1784 msedge.exe 84 PID 1784 wrote to memory of 4328 1784 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a354eb23d5d04b64c2f216894eb809cd_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa405846f8,0x7ffa40584708,0x7ffa405847182⤵PID:4192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,16010952827035207803,4768289087167122343,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:3684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,16010952827035207803,4768289087167122343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,16010952827035207803,4768289087167122343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:82⤵PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16010952827035207803,4768289087167122343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:4008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16010952827035207803,4768289087167122343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:4284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16010952827035207803,4768289087167122343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:12⤵PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,16010952827035207803,4768289087167122343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:82⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,16010952827035207803,4768289087167122343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16010952827035207803,4768289087167122343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:12⤵PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16010952827035207803,4768289087167122343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:12⤵PID:556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16010952827035207803,4768289087167122343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:12⤵PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16010952827035207803,4768289087167122343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:12⤵PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,16010952827035207803,4768289087167122343,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4060 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4356
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3452
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5477462b6ad8eaaf8d38f5e3a4daf17b0
SHA186174e670c44767c08a39cc2a53c09c318326201
SHA256e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
SHA512a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
-
Filesize
152B
MD5b704c9ca0493bd4548ac9c69dc4a4f27
SHA1a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA2562ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
SHA51269c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD55bbe8c8d1b5b6d4070f514161130725e
SHA10ec7256bd7173a1e500afdcc1fa7bd6003db9381
SHA2569972ff97703b3814bbdca810f9b25f915a922a926b492fcd80d5a5c439dd51db
SHA512e2213cfd9d6336d63e4de9881f1967d2aa9c32cd3de17edfb6a06a4306680ef6c62e5c0408d96b9380759421af5918d9d5c13f4a937f42fd2d5faf191bc5a45b
-
Filesize
401B
MD52b9ce5dc010629f12b591c5851a0bfdc
SHA126f5131cd4aa53082636954b57b6b9a90ede5cad
SHA2567c8c605b17227d3bec4061cf5b828e9c4bb90c69e4620704f5c9773f3bff47dd
SHA512a65b1e777911fedb4f58f438c537d6c99359d28c4b8bc67589f4d302ce7d2c2819ba359314ff67d6e79161512287dc2457110d4ab0fd3d29a7091e9f75bac5ea
-
Filesize
6KB
MD554665437c330b3e68c3b3ac690d38c39
SHA12efccab90bf6617014a34ed851f3617965f63387
SHA256fdc80a92996f8f9a3709de280667473921e60c2236e0619e645f791767c89210
SHA512e3a1382bf44b86863786c4322010de2886cb1910bdfb5d2095c2cde7b3faffc9edded4b4f7789ca9109285c6db5aa670dc09728ba6a905b4dc836e5b85361c88
-
Filesize
6KB
MD513e9ccc54c41106af7de7294ad0c12a2
SHA12d908f2ceaff52e2347cb8ed752e6905439edee8
SHA256c12daff349f005339e3a96fb3e6fa859ae6564f0b8421ff5c7aa1c08ab1ca297
SHA512b8c63a636dffec06835e83d173b32292d922d9c1ef10b18a41d886a0e38dfc722aa5331e590b4a667a16d9875e1c78eba9077c979153c74fbd10d35ca92620c0
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD55c1d34484e2df574bd35fc589b49e55a
SHA103a23ea080de61b9e99a4551a240538a288f2290
SHA256cd52b6c6db1aa060c8c2ece17af5e81295c6c9a1c88028cbaeadbc1faa5ea586
SHA512eafac7792c3329751d938ab781f2e46bb507875b25394c34b493f0328fdb1a0a9c87949b95b51b66d473200b93a4c51f7b35ab3076185abcbee322fd4f595093