Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 03:42
Static task
static1
Behavioral task
behavioral1
Sample
a3b4fc5f62a20ee50ca43617c3385300_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a3b4fc5f62a20ee50ca43617c3385300_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a3b4fc5f62a20ee50ca43617c3385300_JaffaCakes118.html
-
Size
19KB
-
MD5
a3b4fc5f62a20ee50ca43617c3385300
-
SHA1
5da093e4d7c3aa5742ed6071c750d47b98c46337
-
SHA256
1e3577018e8cc7ed01a69d94cbc1e8ff3d28f8a23d5acde836af55defe7b5fe7
-
SHA512
737ce40fb6b50d86c96fbf316e8f8cbbc45d6d7c29947f19ec1c58a860baf3be053765fcb1c2421ee0de5bda1a9d5f2f93f4edc50e43b849e28de2b2cc110444
-
SSDEEP
384:zi/lKhJESQVBD8ceQ3RbGUkfpXemLTXucfIk99het8zVc9u:zixSQgcx3tGUYOmWOIk9St6qu
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5104 msedge.exe 5104 msedge.exe 952 msedge.exe 952 msedge.exe 3448 identity_helper.exe 3448 identity_helper.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 952 wrote to memory of 4584 952 msedge.exe 81 PID 952 wrote to memory of 4584 952 msedge.exe 81 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 3676 952 msedge.exe 82 PID 952 wrote to memory of 5104 952 msedge.exe 83 PID 952 wrote to memory of 5104 952 msedge.exe 83 PID 952 wrote to memory of 2576 952 msedge.exe 84 PID 952 wrote to memory of 2576 952 msedge.exe 84 PID 952 wrote to memory of 2576 952 msedge.exe 84 PID 952 wrote to memory of 2576 952 msedge.exe 84 PID 952 wrote to memory of 2576 952 msedge.exe 84 PID 952 wrote to memory of 2576 952 msedge.exe 84 PID 952 wrote to memory of 2576 952 msedge.exe 84 PID 952 wrote to memory of 2576 952 msedge.exe 84 PID 952 wrote to memory of 2576 952 msedge.exe 84 PID 952 wrote to memory of 2576 952 msedge.exe 84 PID 952 wrote to memory of 2576 952 msedge.exe 84 PID 952 wrote to memory of 2576 952 msedge.exe 84 PID 952 wrote to memory of 2576 952 msedge.exe 84 PID 952 wrote to memory of 2576 952 msedge.exe 84 PID 952 wrote to memory of 2576 952 msedge.exe 84 PID 952 wrote to memory of 2576 952 msedge.exe 84 PID 952 wrote to memory of 2576 952 msedge.exe 84 PID 952 wrote to memory of 2576 952 msedge.exe 84 PID 952 wrote to memory of 2576 952 msedge.exe 84 PID 952 wrote to memory of 2576 952 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3b4fc5f62a20ee50ca43617c3385300_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa993e46f8,0x7ffa993e4708,0x7ffa993e47182⤵PID:4584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,18232146982998590688,9886436557416473321,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵PID:3676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,18232146982998590688,9886436557416473321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,18232146982998590688,9886436557416473321,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:82⤵PID:2576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18232146982998590688,9886436557416473321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18232146982998590688,9886436557416473321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:2428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18232146982998590688,9886436557416473321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:12⤵PID:3836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,18232146982998590688,9886436557416473321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:82⤵PID:868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,18232146982998590688,9886436557416473321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18232146982998590688,9886436557416473321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:12⤵PID:3044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18232146982998590688,9886436557416473321,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:12⤵PID:4476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18232146982998590688,9886436557416473321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:12⤵PID:1596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18232146982998590688,9886436557416473321,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:12⤵PID:1060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,18232146982998590688,9886436557416473321,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5760 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2368
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1768
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD581e892ca5c5683efdf9135fe0f2adb15
SHA139159b30226d98a465ece1da28dc87088b20ecad
SHA256830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
SHA512c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
-
Filesize
152B
MD556067634f68231081c4bd5bdbfcc202f
SHA15582776da6ffc75bb0973840fc3d15598bc09eb1
SHA2568c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
SHA512c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5e2d35812232e0226a6908bcec2d9a8ac
SHA182cbac7eaf9a6c7b0aefe751aafbad919683d12a
SHA25675a3703ecbce4f56308626ceda227f1e7467b32527f3afcce4528746bec4c10d
SHA5123f1f730e75a924012ef5c3cbc081782915cfb644ba736e0af1c93b7a176db30a1ee7bc705fbe11427a9a999c4917ddfcbdce24626587125ca3bbb05f8118f099
-
Filesize
410B
MD594b908b0c1676bd79ed696577920a43d
SHA15b671a2a093a26b28834e5db2a8e63e90bb2707a
SHA2561207775b73666c63deaa53b88a0cb0a9c1dc9227c90aa903a3191ac47ebd2712
SHA51229cce05979f42a2c9583361ac66dec22126c55bf6b9b263250c73394df6602f64c5cdf0257c9fe038b090e7a7453670e18a40a1ffc33628252af11ad2c06f1ae
-
Filesize
6KB
MD55392fe0983f6bd5e7568b620e356eb1d
SHA19200c4a12d2b0e5ec3565e5dcc61a219a3b86d92
SHA256406d47f8f411ea9d8d3ecbbecdbdb9d34bb3a3a74fbc6f558843132e9b7f969d
SHA512faa1122a424f1e8a995bd84c8f2b670c9929522b5cac31b58b26b58c90624b5b97d036079f70e590ddddb25746808b0b9f28b12eb61cf6e140b3bfa120827db7
-
Filesize
6KB
MD5f74bac781c19211dbb7077442c8617e7
SHA1930af3939c8d17d0a79a0a490d81019a35a47c30
SHA256c1eb40c38fab54239d08907ed3c811530d9adca0157dc0d2e4d809b274adba73
SHA512d9ef7119b972efca9c8c169745e262bcde77af28eda8ff6befaaf5dcbc343900e19a1484a62900b51fc03cfe15f2cdd2b31b7b21674eec974ca29673a239913d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5ffb767dd06c4f32086c529c0083f553f
SHA15754d2cdc5f5b0e7ab30b3e3042fa07e6919d1fd
SHA256605c3207b2f5abf79ee283e3e7bf1632a78438ddc13411024c050522318eaac3
SHA5129b5e5f690c92eed73e90ca98a1b83e51e7109e9ee6fa213b759361fab76f5a3065e2cf85a346ce9460c74268615239297a630f47fbb82522316d85fb15061a76