Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 02:56
Static task
static1
Behavioral task
behavioral1
Sample
a39a18cd62b6dc8ea7d8be173c6bfc9d_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a39a18cd62b6dc8ea7d8be173c6bfc9d_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a39a18cd62b6dc8ea7d8be173c6bfc9d_JaffaCakes118.html
-
Size
57KB
-
MD5
a39a18cd62b6dc8ea7d8be173c6bfc9d
-
SHA1
fb24c719469c2e52a2ab564f44c266ad94c9fae0
-
SHA256
d4cdfbd5785b62177c013440b86391bbd8701e94c149f438190b323409e2709e
-
SHA512
e1aa3eda804c9dbc391e2f1b906a068585566b5ff0b6a7232ed9caf2036b2f62f626b23f27d0f682b632ab44da38996b8f65b7f526efda2aa4c014c052036e35
-
SSDEEP
1536:dthTDbwmZ3vdBZollya8qBiGliYf02FINKbdj6aOuP1Ua/:3h5VvdBZolltDiGoY/P1Ua/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4348 msedge.exe 4348 msedge.exe 1748 msedge.exe 1748 msedge.exe 3200 identity_helper.exe 3200 identity_helper.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1748 wrote to memory of 1232 1748 msedge.exe 81 PID 1748 wrote to memory of 1232 1748 msedge.exe 81 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 192 1748 msedge.exe 82 PID 1748 wrote to memory of 4348 1748 msedge.exe 83 PID 1748 wrote to memory of 4348 1748 msedge.exe 83 PID 1748 wrote to memory of 1508 1748 msedge.exe 84 PID 1748 wrote to memory of 1508 1748 msedge.exe 84 PID 1748 wrote to memory of 1508 1748 msedge.exe 84 PID 1748 wrote to memory of 1508 1748 msedge.exe 84 PID 1748 wrote to memory of 1508 1748 msedge.exe 84 PID 1748 wrote to memory of 1508 1748 msedge.exe 84 PID 1748 wrote to memory of 1508 1748 msedge.exe 84 PID 1748 wrote to memory of 1508 1748 msedge.exe 84 PID 1748 wrote to memory of 1508 1748 msedge.exe 84 PID 1748 wrote to memory of 1508 1748 msedge.exe 84 PID 1748 wrote to memory of 1508 1748 msedge.exe 84 PID 1748 wrote to memory of 1508 1748 msedge.exe 84 PID 1748 wrote to memory of 1508 1748 msedge.exe 84 PID 1748 wrote to memory of 1508 1748 msedge.exe 84 PID 1748 wrote to memory of 1508 1748 msedge.exe 84 PID 1748 wrote to memory of 1508 1748 msedge.exe 84 PID 1748 wrote to memory of 1508 1748 msedge.exe 84 PID 1748 wrote to memory of 1508 1748 msedge.exe 84 PID 1748 wrote to memory of 1508 1748 msedge.exe 84 PID 1748 wrote to memory of 1508 1748 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a39a18cd62b6dc8ea7d8be173c6bfc9d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc47d446f8,0x7ffc47d44708,0x7ffc47d447182⤵PID:1232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,12753990684137764715,3550411013182772137,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:22⤵PID:192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,12753990684137764715,3550411013182772137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,12753990684137764715,3550411013182772137,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵PID:1508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,12753990684137764715,3550411013182772137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:1040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,12753990684137764715,3550411013182772137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,12753990684137764715,3550411013182772137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:82⤵PID:2592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,12753990684137764715,3550411013182772137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,12753990684137764715,3550411013182772137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:12⤵PID:4444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,12753990684137764715,3550411013182772137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:12⤵PID:2936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,12753990684137764715,3550411013182772137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:12⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,12753990684137764715,3550411013182772137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:12⤵PID:3576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,12753990684137764715,3550411013182772137,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4080
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3868
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5477462b6ad8eaaf8d38f5e3a4daf17b0
SHA186174e670c44767c08a39cc2a53c09c318326201
SHA256e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
SHA512a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
-
Filesize
152B
MD5b704c9ca0493bd4548ac9c69dc4a4f27
SHA1a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA2562ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
SHA51269c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
-
Filesize
177B
MD5af208c6bb14127eea0541bed38bd0a06
SHA1c5f4da6f0726b3f85cd81f2b4ec5aade4915baa9
SHA256fdc65b15d14ebfe8c39ae462afbdd24f95e471d3d72c93e1bd71b64dc5c46c42
SHA512d6fa99f77819d99a717d9a107004562136d4fe4cb5e3f045c317a87419e93be2b4f630f53165d3ea508cf18eed04a88fa527cb78bb82f71bd3740e1e032b7727
-
Filesize
6KB
MD5c594393cd113bb2687ac8efa54f78d0c
SHA1b1375e63656bbb105a63834643ac3ce0543ccb31
SHA256fe7e3cdc331db7247ea57314d1bc11db5cf45e8f774d6218b90ada866d421af3
SHA512f40e3c5e6e21b834af922cbe2629069531e3c8dac58865ef50c08f3827605eca1c131494e6d41610fb391aec36c958f8ea12b6d3d6ac1fb9cd6f1704e6784554
-
Filesize
6KB
MD56b3a4201929f3203e86179e509681b95
SHA194e597b5eb14506aa4b9a0f4b21d4b196842313e
SHA256729e3223ac67bd8d101e7da7f130264c8fcb40d9ce22f9b937ed220a2e9e20a5
SHA512d506a76128f551e63b648f71992bf12684d3148559c29f1030f3b3e00c4ccf563e6777664f6a7379245f55153fd6cf88b7e73064dd9f903c31c33adb39c85de8
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5c2d049cfb8d44b0519bcd421afdffd16
SHA1b166832d209c75b34f3c1cf293c60dd4c636a84a
SHA2564952d46e420eac8207369112d624816445adc6cc7366064ede1c718a41c80564
SHA512cbfbc4d9f3f0423a91138431dff1d6f7ec6598ff917bc42b6959599aeaae01eb5d42bb0711e5db251f9c5cfeeef501c66e3c1b87a44243d0781017aeaf40f2be