Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 02:45
Static task
static1
Behavioral task
behavioral1
Sample
a394532d80e54e7b1ce75613417b8f8d_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a394532d80e54e7b1ce75613417b8f8d_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a394532d80e54e7b1ce75613417b8f8d_JaffaCakes118.html
-
Size
164KB
-
MD5
a394532d80e54e7b1ce75613417b8f8d
-
SHA1
095e586a2f699b9eea2b7439304c0440ea1e5283
-
SHA256
23f7e777fb8840cd8953cf400a4c34d1947bb933a9e642427f3a10973ba9ce27
-
SHA512
7089b6306770a31210be986e11aaf96a41d734dae95a86cf895e770f8025eeda471b0baff67f29cec6443ff1843e0e83b52ce1c8289662e4111f5009052fce5b
-
SSDEEP
1536:wgicvpeQesR2CwzMe9I3ReoL/CedeSeZeseg3sDeQe5mHlkJGiEyJBqmeppOlQeo:wgiccGPi3sgmHeJe7dBcWAd961BYY9Vb
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4760 msedge.exe 4760 msedge.exe 4500 msedge.exe 4500 msedge.exe 880 identity_helper.exe 880 identity_helper.exe 2512 msedge.exe 2512 msedge.exe 2512 msedge.exe 2512 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4500 wrote to memory of 4940 4500 msedge.exe 81 PID 4500 wrote to memory of 4940 4500 msedge.exe 81 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 3428 4500 msedge.exe 82 PID 4500 wrote to memory of 4760 4500 msedge.exe 83 PID 4500 wrote to memory of 4760 4500 msedge.exe 83 PID 4500 wrote to memory of 4516 4500 msedge.exe 84 PID 4500 wrote to memory of 4516 4500 msedge.exe 84 PID 4500 wrote to memory of 4516 4500 msedge.exe 84 PID 4500 wrote to memory of 4516 4500 msedge.exe 84 PID 4500 wrote to memory of 4516 4500 msedge.exe 84 PID 4500 wrote to memory of 4516 4500 msedge.exe 84 PID 4500 wrote to memory of 4516 4500 msedge.exe 84 PID 4500 wrote to memory of 4516 4500 msedge.exe 84 PID 4500 wrote to memory of 4516 4500 msedge.exe 84 PID 4500 wrote to memory of 4516 4500 msedge.exe 84 PID 4500 wrote to memory of 4516 4500 msedge.exe 84 PID 4500 wrote to memory of 4516 4500 msedge.exe 84 PID 4500 wrote to memory of 4516 4500 msedge.exe 84 PID 4500 wrote to memory of 4516 4500 msedge.exe 84 PID 4500 wrote to memory of 4516 4500 msedge.exe 84 PID 4500 wrote to memory of 4516 4500 msedge.exe 84 PID 4500 wrote to memory of 4516 4500 msedge.exe 84 PID 4500 wrote to memory of 4516 4500 msedge.exe 84 PID 4500 wrote to memory of 4516 4500 msedge.exe 84 PID 4500 wrote to memory of 4516 4500 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a394532d80e54e7b1ce75613417b8f8d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabd7046f8,0x7ffabd704708,0x7ffabd7047182⤵PID:4940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,1050582385423026333,9524762677396519469,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2488 /prefetch:22⤵PID:3428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,1050582385423026333,9524762677396519469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,1050582385423026333,9524762677396519469,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:82⤵PID:4516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1050582385423026333,9524762677396519469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:3836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1050582385423026333,9524762677396519469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:4100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1050582385423026333,9524762677396519469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:12⤵PID:2512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,1050582385423026333,9524762677396519469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:82⤵PID:2072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,1050582385423026333,9524762677396519469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1050582385423026333,9524762677396519469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:12⤵PID:4204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1050582385423026333,9524762677396519469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:12⤵PID:3752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1050582385423026333,9524762677396519469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:12⤵PID:660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1050582385423026333,9524762677396519469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:12⤵PID:4896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,1050582385423026333,9524762677396519469,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2512
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2660
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dabfafd78687947a9de64dd5b776d25f
SHA116084c74980dbad713f9d332091985808b436dea
SHA256c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
SHA512dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
-
Filesize
152B
MD5c39b3aa574c0c938c80eb263bb450311
SHA1f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA25666f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
SHA512eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5919fd183b28a532178a5bf9e9233bca8
SHA1cd2a09cd56814925bc223758bbaeddd00d6c40b6
SHA2569e56e8d7f596018aeda82cc14ca57a217c00146b6d095d7d0f8c973c58c3839d
SHA512ef5213188a1dd728dc1506e2a32c511749ec0e55bcfe67ff3d0a007733cc064e4aeddddd53ee4004e33592895c0ee6afad26a4c4c461e7db1c34ca645e27e02a
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
946B
MD56fa177b78a45affcff61f402a095e75a
SHA1d7b536c545e28e081949de1c36923cb198318f13
SHA2564970e152929845701559eaf2ca8e45b5ff2acaa10b3f6eb71f677906b4848083
SHA512f013673566a9714eec4f8f6727dff2bcda029c09d81a0fb2a8eb1061b2cdedc9010039906d934cf4a2b0f8ac13491a765fba45bcea81146153491ea0f2823ab4
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
6KB
MD5744b204240bc41e4bb7a60dc44539722
SHA1324985fcfb1ade1c817f2641dc3ca3fb56452ba9
SHA2567aa8753e40133107828ce13a79f415e20b8d13857df4967117da7356078db512
SHA512e51bd4ca5c5d22a01a3cae4c80353032d12702085ac822bea73188c9c53ab2e5208a7d1394e51ad15457c8e0f391feceb728386fcc15338601ae57b79ebfe0db
-
Filesize
6KB
MD5abcd4d322b4a61baeb4701a2efea4cd4
SHA149bb0d53f75554cc638c76ee328b799324fe34ff
SHA256e17ec886a5171ccafca16af0f725a0f42f3146cda3dfaf260ff4de87c3a7110d
SHA512b7da345eecd78f4f44ae8b0f20ad030875f20b1b4f3e7b01c3e4b6e9704c5048be18969fc90fde03a3df43c13189b89e0a2790c1693ede80326119a28499dbd1
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD547417e57daffb81e2d2e828054992d31
SHA10ef6843d65310e2e3a481636fb99de34a43c108b
SHA2561224c5f3e49d68e1f7631b44120ff703baa2634f67a792bae503270d176af120
SHA51240ffdcedfa081dd0fcd1febd7a804cec33a7fc1426cb1d9bc09337dabc8ad61fe5ae60830c686be09ac34800248f09b3133f2cac855303c820a681b52352ff1f