Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 03:35
Static task
static1
Behavioral task
behavioral1
Sample
a3b1010b667923a06e1b3725aae76ff5_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a3b1010b667923a06e1b3725aae76ff5_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a3b1010b667923a06e1b3725aae76ff5_JaffaCakes118.html
-
Size
17KB
-
MD5
a3b1010b667923a06e1b3725aae76ff5
-
SHA1
ca9e90283dae9124c9b388fa19cfc6ff18ffdcb7
-
SHA256
9e5811510fd21ac9d3355da31f5eecb014b06b957b4d94c290ea690a46fdefe5
-
SHA512
51c89571219e4b11215a81caf1547ebd4c5b270d926aca7053abcbdf6564188629993d13efc1cfc3b86ee9dfd2ddcc84adb3dcf74da6b9ba6c5d22401321f316
-
SSDEEP
384:xAFTw5gcCm3tIBBiSlyNVfltzhrZMndfyEB:xAFTw5gcCKaHiSl+x7Mh
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3148 msedge.exe 3148 msedge.exe 3700 msedge.exe 3700 msedge.exe 2548 identity_helper.exe 2548 identity_helper.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe 4284 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3700 wrote to memory of 3228 3700 msedge.exe 82 PID 3700 wrote to memory of 3228 3700 msedge.exe 82 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 1624 3700 msedge.exe 83 PID 3700 wrote to memory of 3148 3700 msedge.exe 84 PID 3700 wrote to memory of 3148 3700 msedge.exe 84 PID 3700 wrote to memory of 1200 3700 msedge.exe 85 PID 3700 wrote to memory of 1200 3700 msedge.exe 85 PID 3700 wrote to memory of 1200 3700 msedge.exe 85 PID 3700 wrote to memory of 1200 3700 msedge.exe 85 PID 3700 wrote to memory of 1200 3700 msedge.exe 85 PID 3700 wrote to memory of 1200 3700 msedge.exe 85 PID 3700 wrote to memory of 1200 3700 msedge.exe 85 PID 3700 wrote to memory of 1200 3700 msedge.exe 85 PID 3700 wrote to memory of 1200 3700 msedge.exe 85 PID 3700 wrote to memory of 1200 3700 msedge.exe 85 PID 3700 wrote to memory of 1200 3700 msedge.exe 85 PID 3700 wrote to memory of 1200 3700 msedge.exe 85 PID 3700 wrote to memory of 1200 3700 msedge.exe 85 PID 3700 wrote to memory of 1200 3700 msedge.exe 85 PID 3700 wrote to memory of 1200 3700 msedge.exe 85 PID 3700 wrote to memory of 1200 3700 msedge.exe 85 PID 3700 wrote to memory of 1200 3700 msedge.exe 85 PID 3700 wrote to memory of 1200 3700 msedge.exe 85 PID 3700 wrote to memory of 1200 3700 msedge.exe 85 PID 3700 wrote to memory of 1200 3700 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3b1010b667923a06e1b3725aae76ff5_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeba3b46f8,0x7ffeba3b4708,0x7ffeba3b47182⤵PID:3228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,9172819574782054033,1589211983647498241,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:1624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,9172819574782054033,1589211983647498241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,9172819574782054033,1589211983647498241,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:82⤵PID:1200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,9172819574782054033,1589211983647498241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,9172819574782054033,1589211983647498241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,9172819574782054033,1589211983647498241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:12⤵PID:2552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,9172819574782054033,1589211983647498241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:82⤵PID:4304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,9172819574782054033,1589211983647498241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,9172819574782054033,1589211983647498241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:12⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,9172819574782054033,1589211983647498241,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:12⤵PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,9172819574782054033,1589211983647498241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:12⤵PID:1760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,9172819574782054033,1589211983647498241,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:12⤵PID:1080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,9172819574782054033,1589211983647498241,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5180 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4284
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3128
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dabfafd78687947a9de64dd5b776d25f
SHA116084c74980dbad713f9d332091985808b436dea
SHA256c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
SHA512dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
-
Filesize
152B
MD5c39b3aa574c0c938c80eb263bb450311
SHA1f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA25666f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
SHA512eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD5b9c5902e9e812b6aabf2f15d0311cb4a
SHA1c6280ee7f53b02c1813aa0a3bbb7f3fba42304f6
SHA25687261d312c0244c57c45b66c30b3e4dc2b912522bf68fd00deca6b73cf5ffb51
SHA51252f6fd4d451524fb4510125a6371b1c0eaa4be536973f7b732cf91fa34a69811f6b2ef5cb5a3c7f7ce9bcf30d1ddf4090ef13024c24ea9361e07a0c52e8c5c6b
-
Filesize
527B
MD5f8130ea759a79e839f0e4ce91bfb06eb
SHA14162e2a9526a189eba5cff2735018d0454089f30
SHA2563c7533889a5c80cfd77fe61881270bde7e30c45c53d568d5733cb6b6b1ee268e
SHA5120a60a5301038589468404f4e41b4247be1a8b8e0d5545a8df37060b497f5e398abacc73ee057aef6b5f9539d2a5493d8524ea6ff711c33b3d8695649770fcafc
-
Filesize
6KB
MD594b2224aa044e1414399de2d0a789112
SHA1a88b9bc61cda9cc388812cfbce551dfac25f9482
SHA256bae20f4ff6bc3a215638a1ca12db49cbda75843ef68021fc61ab3b9723fbe9b6
SHA512919ce5b12e2f007be7e8e69fa29de7f11d2da4a1624d9339c1e3e20dc2a1d3f05ebccffef3b58ad9bc00b193f93dd9e11552062490fbdd4b4a617efe11f16180
-
Filesize
6KB
MD5b9f8877b1cafad463c5f5ebc340309e6
SHA10b8cf8a23ba6fe174415bd31514c0a4a22908203
SHA256a55b3c3587fc76213b3a72df5e8a5fa761a54458b787e307e415b9fd8aa26682
SHA512bea7cbc710ee5deeaf26d1b83437641ede72e855efab62d2a8b7351a2680e1c5936446bcc62c426add849940b091cd162157fd76e1f50570bcc8526ae4e83252
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5a81ffab44d9f7af727cb5a0bb8f1f9f8
SHA1e248da133882b57cdef948fa101fe16a458c5e37
SHA2562bbdef7bc70fbc0557c86cadffa8840d66c0e3a3afc6dfac60cebcbcde006f3b
SHA51297cc237abb8c85214320859dcc20bc7e807d2f0140d0d794766bfe884b667733312a1d843ae2f28765a5c604bce8ee9efcdf2a983152f924a3f841f735c3b962