Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 02:58
Static task
static1
Behavioral task
behavioral1
Sample
a39b6b33003115ef5353cf8ad1e11dd8_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a39b6b33003115ef5353cf8ad1e11dd8_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a39b6b33003115ef5353cf8ad1e11dd8_JaffaCakes118.html
-
Size
30KB
-
MD5
a39b6b33003115ef5353cf8ad1e11dd8
-
SHA1
1ba0ee706d970f5b86478a8191a83551ac82c208
-
SHA256
fe4b76e507c584ef213be7cfdaf380a57046f459cd7c217d0e4a20fbe80364b8
-
SHA512
3151111933cc25ab705261b07e0a5596fd8591c466f90a5bb3635867799a5763ad5f1ac24f4d8e7d5267b9fb50764b6f6c8b8d9597aff92a30b14c26d10af896
-
SSDEEP
384:SpBQuXu6iWCnmisohJxQKbtewdunAfZHBMboTwj4+PFRA271bs3ueOv4:SUuXVOBPhJxQKbtewdbHCzj4WFRAirw
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1100 msedge.exe 1100 msedge.exe 2348 msedge.exe 2348 msedge.exe 3732 identity_helper.exe 3732 identity_helper.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe 2348 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 3108 2348 msedge.exe 82 PID 2348 wrote to memory of 3108 2348 msedge.exe 82 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 4804 2348 msedge.exe 84 PID 2348 wrote to memory of 1100 2348 msedge.exe 85 PID 2348 wrote to memory of 1100 2348 msedge.exe 85 PID 2348 wrote to memory of 4512 2348 msedge.exe 86 PID 2348 wrote to memory of 4512 2348 msedge.exe 86 PID 2348 wrote to memory of 4512 2348 msedge.exe 86 PID 2348 wrote to memory of 4512 2348 msedge.exe 86 PID 2348 wrote to memory of 4512 2348 msedge.exe 86 PID 2348 wrote to memory of 4512 2348 msedge.exe 86 PID 2348 wrote to memory of 4512 2348 msedge.exe 86 PID 2348 wrote to memory of 4512 2348 msedge.exe 86 PID 2348 wrote to memory of 4512 2348 msedge.exe 86 PID 2348 wrote to memory of 4512 2348 msedge.exe 86 PID 2348 wrote to memory of 4512 2348 msedge.exe 86 PID 2348 wrote to memory of 4512 2348 msedge.exe 86 PID 2348 wrote to memory of 4512 2348 msedge.exe 86 PID 2348 wrote to memory of 4512 2348 msedge.exe 86 PID 2348 wrote to memory of 4512 2348 msedge.exe 86 PID 2348 wrote to memory of 4512 2348 msedge.exe 86 PID 2348 wrote to memory of 4512 2348 msedge.exe 86 PID 2348 wrote to memory of 4512 2348 msedge.exe 86 PID 2348 wrote to memory of 4512 2348 msedge.exe 86 PID 2348 wrote to memory of 4512 2348 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a39b6b33003115ef5353cf8ad1e11dd8_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff896dd46f8,0x7ff896dd4708,0x7ff896dd47182⤵PID:3108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13780171237416087095,2109565084275446014,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:4804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,13780171237416087095,2109565084275446014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,13780171237416087095,2109565084275446014,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:82⤵PID:4512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13780171237416087095,2109565084275446014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:4932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13780171237416087095,2109565084275446014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13780171237416087095,2109565084275446014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:12⤵PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13780171237416087095,2109565084275446014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:82⤵PID:324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13780171237416087095,2109565084275446014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13780171237416087095,2109565084275446014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:12⤵PID:2024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13780171237416087095,2109565084275446014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵PID:844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13780171237416087095,2109565084275446014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:12⤵PID:2264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13780171237416087095,2109565084275446014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:12⤵PID:3104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13780171237416087095,2109565084275446014,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4936 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:852
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3568
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2456
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c5abc082d9d9307e797b7e89a2f755f4
SHA154c442690a8727f1d3453b6452198d3ec4ec13df
SHA256a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
SHA512ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
-
Filesize
152B
MD5b4a74bc775caf3de7fc9cde3c30ce482
SHA1c6ed3161390e5493f71182a6cb98d51c9063775d
SHA256dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
SHA51255578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
-
Filesize
554B
MD53c1ec48e26cf568d10286ac74bf9013d
SHA1e72dc43077539972ef733800df223c8a90bc8216
SHA256bea31c1065ce184819b2e8725932592fe67cefe95fa9211fcf86e7b398e90892
SHA512333eee04235ecbd1206f693f6b7dd0ed4d4d2e5340d64e3cc5da63f0c5821ab94cf9b4c41c32e291f7805c1caa32154ee55e50b2d40bdfdadaa4325a0711845f
-
Filesize
6KB
MD55cdcaf02c373090181d3bbd851525bcb
SHA10426d3c6c9a040f7d07f8d4458d8c9bb3cd5d2c8
SHA25627d272583bc76306da8abfc4f7c1d0842a745d5851d09246e3b413ea279bcdc8
SHA5124645ec2971597d66fec942cf30779b8adbd02aa47d743bbd77b421c9180ecfde77d2109122f411899a5f78ad59f49bbaf799da1bd315375136c8698088d642a1
-
Filesize
6KB
MD5e737d90f6d9c357c9357f23f6d5d852b
SHA157ab1b77c2fcc442d2f6987ebeed162f8ce00d42
SHA256630e6cca59e9633f54f336d8c1d9bf2aad9c09d5a4f2cb48c2a6874b2bee28fc
SHA512df9e52f3cca8bd55f537b3c30eeb2828424ec9d678c3b9ca41a84626fe7dd0edb3e2f4e6ac1e39f980408d9f3c8b0555e02b42328df37135efd00c801d240439
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD5f51315f90e17f9be77707bb65b40bba9
SHA1cf998c84e8ac2841079af41c98aae6d041af2f07
SHA256aa32405ecdd4f1a2fdcceab805658b0c4b73eee234aecff6389eeb3eb70c3cf8
SHA51206509b193dbe03ab33c70574edfba03f9d2f2f57a21cb9c589fc3a956c79e2e8caf94e378dbfcedadd15c48e687c457e8c6c682e34e315631879d389dc682065