Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 03:39
Static task
static1
Behavioral task
behavioral1
Sample
a3b357bbe48a276e4cef31bf4d2fa3f1_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a3b357bbe48a276e4cef31bf4d2fa3f1_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a3b357bbe48a276e4cef31bf4d2fa3f1_JaffaCakes118.html
-
Size
51KB
-
MD5
a3b357bbe48a276e4cef31bf4d2fa3f1
-
SHA1
763ed96a06d5d2b5736170b4d3bb5bcf6369983b
-
SHA256
04af3fb6933a6c53dd102eea6ade385edb566466447bd63f380567419efdc6dd
-
SHA512
d6478ce3271bb1aef76ea3aa377a69a6e9d4375b80dda3c7e6fa92dbb20c9a7b27e7452c96a4baaf4fc892b5d6ae02d5dcf159b3a59fc1b3575c3a779fbd6384
-
SSDEEP
1536:i5w5GAzqzso5Kms/3oFDt10UsXO2aN7vBaS8BePTEoVqQ:Iw5tqYOvBaS8BePTEoVt
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 904 msedge.exe 904 msedge.exe 1840 msedge.exe 1840 msedge.exe 400 identity_helper.exe 400 identity_helper.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1840 wrote to memory of 4808 1840 msedge.exe 82 PID 1840 wrote to memory of 4808 1840 msedge.exe 82 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 3212 1840 msedge.exe 83 PID 1840 wrote to memory of 904 1840 msedge.exe 84 PID 1840 wrote to memory of 904 1840 msedge.exe 84 PID 1840 wrote to memory of 3372 1840 msedge.exe 85 PID 1840 wrote to memory of 3372 1840 msedge.exe 85 PID 1840 wrote to memory of 3372 1840 msedge.exe 85 PID 1840 wrote to memory of 3372 1840 msedge.exe 85 PID 1840 wrote to memory of 3372 1840 msedge.exe 85 PID 1840 wrote to memory of 3372 1840 msedge.exe 85 PID 1840 wrote to memory of 3372 1840 msedge.exe 85 PID 1840 wrote to memory of 3372 1840 msedge.exe 85 PID 1840 wrote to memory of 3372 1840 msedge.exe 85 PID 1840 wrote to memory of 3372 1840 msedge.exe 85 PID 1840 wrote to memory of 3372 1840 msedge.exe 85 PID 1840 wrote to memory of 3372 1840 msedge.exe 85 PID 1840 wrote to memory of 3372 1840 msedge.exe 85 PID 1840 wrote to memory of 3372 1840 msedge.exe 85 PID 1840 wrote to memory of 3372 1840 msedge.exe 85 PID 1840 wrote to memory of 3372 1840 msedge.exe 85 PID 1840 wrote to memory of 3372 1840 msedge.exe 85 PID 1840 wrote to memory of 3372 1840 msedge.exe 85 PID 1840 wrote to memory of 3372 1840 msedge.exe 85 PID 1840 wrote to memory of 3372 1840 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3b357bbe48a276e4cef31bf4d2fa3f1_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcac9d46f8,0x7ffcac9d4708,0x7ffcac9d47182⤵PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4718946047667427511,646619564250858009,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:3212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4718946047667427511,646619564250858009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4718946047667427511,646619564250858009,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:82⤵PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4718946047667427511,646619564250858009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4718946047667427511,646619564250858009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4718946047667427511,646619564250858009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:12⤵PID:2976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4718946047667427511,646619564250858009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:12⤵PID:4316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4718946047667427511,646619564250858009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:82⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4718946047667427511,646619564250858009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4718946047667427511,646619564250858009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:12⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4718946047667427511,646619564250858009,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:12⤵PID:768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4718946047667427511,646619564250858009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:12⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4718946047667427511,646619564250858009,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:12⤵PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4718946047667427511,646619564250858009,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1004
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3908
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5477462b6ad8eaaf8d38f5e3a4daf17b0
SHA186174e670c44767c08a39cc2a53c09c318326201
SHA256e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
SHA512a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
-
Filesize
152B
MD5b704c9ca0493bd4548ac9c69dc4a4f27
SHA1a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA2562ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
SHA51269c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD58e76e51f8283f58e52d8d1279e7fc507
SHA12743ba1e8b37a00b0b235730729c1b3643be615d
SHA2564349cf4b5c661fff88febd08839de98b8bc5c32dd0aa8b52c1214626fd873751
SHA51258f02d400b38386c9a15ed674c18c06bd196ef82afbef89e32357f0ab6f893558a33cc22f44a120c8a2412286890325e52d3d54a3e0a24f8a6f5f0456a9a1cd8
-
Filesize
1KB
MD5206608045c9ee5c8a5a5c0d9ce77a456
SHA143153d408f9e4e51bbdfa38a9014b263e623ff29
SHA2569aba54a4a53ee58eed085b9178c936d501ad8091071aad137cc2afd42c71a55e
SHA512979bb7ba40cd043193097aadaeb7e6ab9cf441041521f3d439daa2e1d19d6399786741427b3c3d3d9e87a3606db2b827fd4e31ca030abd9c50f9614d13617995
-
Filesize
387B
MD55e0d9a9d587c2d4d8d3e5bd14921b448
SHA1e68f8bd671ef37110c567b9f4d42ce14fba4eefb
SHA256a58d3f40de89560e32f1fbf5424e115bcba770e482df94f6db337301933707db
SHA512426c61a4c24d22bb10a435e47f241f6cfa31601655dd7c6e4af7470fe347b3fa335f02407ef42e863b2d66c398c40112f065ac63536cfe491cb74999ca69706a
-
Filesize
6KB
MD5f4303f565e6e0959e369a4797f9c3322
SHA1076082aa498e45ec562d4915ec347028f7543ac9
SHA256ddb65cb5b173ec8c476349ad75208985828d3ff1a520230d9f75acd237473451
SHA5123f1794d1d351e57478e0d13f3aceeac89bb9c60ed49f311e78751106fe125060f73c96ababd06dc04094425f457a46261e9e6361fdd90c672e2859eb560cc5ef
-
Filesize
6KB
MD58378c41e3c4da5c798487fc0925ec46f
SHA1363623bc72acc677a62e541df9eb6b33dfab40aa
SHA25655d3911e594b9426952b28118863de00709230ffb2451116ae2ed231c233f8fa
SHA51265d4c9819a2839f87b1296a35c955777adcc39ce489901111a07da3381540de825bc624f330df149c7319e3d3a4f5263bd6f8048cee55badf46a6261af5ca79a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD56e56653cbcadb7c134ac2725095f54b2
SHA1c6935601306094067378ba2d39501de9a816808a
SHA2563cbc534e66979a18aa89b538cfd487645925a974d64a55fb9fc9537d91a44164
SHA512d8c23b5dde389333322b4fa2845991c228c19ed16b989ad39b5c90200c9491f1b63f8f2241d548abde065a1e899e4edf600988051a52654c3b187fe3422fac83