Analysis
-
max time kernel
145s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 03:42
Static task
static1
Behavioral task
behavioral1
Sample
a3b59d16212d678ba8821ac20c6e0442_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a3b59d16212d678ba8821ac20c6e0442_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a3b59d16212d678ba8821ac20c6e0442_JaffaCakes118.html
-
Size
19KB
-
MD5
a3b59d16212d678ba8821ac20c6e0442
-
SHA1
d39fabdcce7460d4166a31140e92919aabb2f1f5
-
SHA256
45ad4c17b0def64a219268556c8dc0878a7bfc5861ec93f1edb29ce339e3caf8
-
SHA512
034740149bd5c664f01588aee49db682c33aa024a1acd1c941defe0ce2637f59be0632a40a8e2ef1363f118a413c50bc05f65b7795427ece1586610f71ce7472
-
SSDEEP
192:uwXkb5nzBnQjxn5Q/KnQie5NnfnQOkEntucnQTbnxnQmSgHMBZqnYnQ5INnlnQV0:JQ/MqCq5
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3312 msedge.exe 3312 msedge.exe 1056 msedge.exe 1056 msedge.exe 4596 identity_helper.exe 4596 identity_helper.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1056 wrote to memory of 3572 1056 msedge.exe 83 PID 1056 wrote to memory of 3572 1056 msedge.exe 83 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 4452 1056 msedge.exe 84 PID 1056 wrote to memory of 3312 1056 msedge.exe 85 PID 1056 wrote to memory of 3312 1056 msedge.exe 85 PID 1056 wrote to memory of 4948 1056 msedge.exe 86 PID 1056 wrote to memory of 4948 1056 msedge.exe 86 PID 1056 wrote to memory of 4948 1056 msedge.exe 86 PID 1056 wrote to memory of 4948 1056 msedge.exe 86 PID 1056 wrote to memory of 4948 1056 msedge.exe 86 PID 1056 wrote to memory of 4948 1056 msedge.exe 86 PID 1056 wrote to memory of 4948 1056 msedge.exe 86 PID 1056 wrote to memory of 4948 1056 msedge.exe 86 PID 1056 wrote to memory of 4948 1056 msedge.exe 86 PID 1056 wrote to memory of 4948 1056 msedge.exe 86 PID 1056 wrote to memory of 4948 1056 msedge.exe 86 PID 1056 wrote to memory of 4948 1056 msedge.exe 86 PID 1056 wrote to memory of 4948 1056 msedge.exe 86 PID 1056 wrote to memory of 4948 1056 msedge.exe 86 PID 1056 wrote to memory of 4948 1056 msedge.exe 86 PID 1056 wrote to memory of 4948 1056 msedge.exe 86 PID 1056 wrote to memory of 4948 1056 msedge.exe 86 PID 1056 wrote to memory of 4948 1056 msedge.exe 86 PID 1056 wrote to memory of 4948 1056 msedge.exe 86 PID 1056 wrote to memory of 4948 1056 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3b59d16212d678ba8821ac20c6e0442_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb53f46f8,0x7ffbb53f4708,0x7ffbb53f47182⤵PID:3572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2272,13115811941732512071,9394094136865769764,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:22⤵PID:4452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2272,13115811941732512071,9394094136865769764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2272,13115811941732512071,9394094136865769764,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:82⤵PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,13115811941732512071,9394094136865769764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:5620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,13115811941732512071,9394094136865769764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2272,13115811941732512071,9394094136865769764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:82⤵PID:320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2272,13115811941732512071,9394094136865769764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,13115811941732512071,9394094136865769764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:12⤵PID:3864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,13115811941732512071,9394094136865769764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:12⤵PID:5268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,13115811941732512071,9394094136865769764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:12⤵PID:2068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,13115811941732512071,9394094136865769764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:4376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2272,13115811941732512071,9394094136865769764,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4200 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4924
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2124
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5477462b6ad8eaaf8d38f5e3a4daf17b0
SHA186174e670c44767c08a39cc2a53c09c318326201
SHA256e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
SHA512a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
-
Filesize
152B
MD5b704c9ca0493bd4548ac9c69dc4a4f27
SHA1a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA2562ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
SHA51269c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
6KB
MD57d61c4bf6ad2da633fee4aa0258fdfc2
SHA140d11bde22a7ce918b8a42819bb84bd28ac2107b
SHA2563e90c339227f25aeca7cdb0054f26e4ec5b348c747dd5bb38109b0f50c855387
SHA5126fa3bef794080b68de80590c85f5634237cd9928966eac48328359790094b8d34911e997be951d7c6c878da075d70213f1e338ab0555436667fdf3789fcfd725
-
Filesize
6KB
MD5aa74c62e9b63e043b30d973aaedb0f04
SHA159bae4052dee903a1e5aa00fceaa9db30d531fc6
SHA2567ebb7c3cb8533b1cb8c2ceee449cb658b40a54e364fce0cb1e0d0e1642b8164c
SHA512d0b5739431cb0b11527b5dcd96b3feb947d3cd38329c71ded2926276a9b7df29bf3266c31c9826f4ed89bb93a0d7375ca3a84f364f0fc02fb7d4b3729f2668bf
-
Filesize
6KB
MD5263314e8bd170c9256b79d43d32d8dff
SHA1571924c5c4c77a889b6cc21954d44e54a693cba1
SHA256d3e80eb84e73576af40731ede1d2db7fadd320df7c1f0f2c214b1b8d4ebd68ce
SHA51249965bd6ce738c5f2e43f04495a15f0bb1f720076b12cb4948ca580768663ca2d52a7cddd4fdcff471ba26b0b0dc46df5c6c2ece1167374c1aa57ee92613ad55
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5c5c9ca9ed4d188fdd188bdff4c6e0099
SHA18bae9a210607e415168c2f841ae2f52a5b405233
SHA256202a060585936f906f82d6562485a3ba2fc270bf0652805792e753b123dbf14a
SHA512fdcf8cc0247db01f576f3824eb96956b1eec944fb35b7ab82cce98500f8d8616a01184d3f5d141849e7f4ceef37263d3a08c409e1c7c3533fb192231cf83c4d8