Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 05:02
Static task
static1
Behavioral task
behavioral1
Sample
a3e7426e33eec5574bc29823769cd6e5_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a3e7426e33eec5574bc29823769cd6e5_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a3e7426e33eec5574bc29823769cd6e5_JaffaCakes118.html
-
Size
16KB
-
MD5
a3e7426e33eec5574bc29823769cd6e5
-
SHA1
676105ba2dc4641b0deb83f5884a077732ae5fab
-
SHA256
df523a306c62918713fb815f130b315d2de1139b90ce0caa461cb6957a7b38c7
-
SHA512
45ec0f0f493b29711805816e1a3f577293c943301118041de7e4d29bc5eda0bcfb5a2cac34c12954e4c0e8482994ad034bb889444054f920c9e747dbf544a912
-
SSDEEP
384:j8GMFLiCoqqf6jIB5KnDkRgP/uGb6CatG:j8Gse9q9jIr2DcgP/uGb6CaQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2416 msedge.exe 2416 msedge.exe 3220 msedge.exe 3220 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3220 msedge.exe 3220 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3220 wrote to memory of 1580 3220 msedge.exe 83 PID 3220 wrote to memory of 1580 3220 msedge.exe 83 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 3804 3220 msedge.exe 85 PID 3220 wrote to memory of 2416 3220 msedge.exe 86 PID 3220 wrote to memory of 2416 3220 msedge.exe 86 PID 3220 wrote to memory of 1420 3220 msedge.exe 87 PID 3220 wrote to memory of 1420 3220 msedge.exe 87 PID 3220 wrote to memory of 1420 3220 msedge.exe 87 PID 3220 wrote to memory of 1420 3220 msedge.exe 87 PID 3220 wrote to memory of 1420 3220 msedge.exe 87 PID 3220 wrote to memory of 1420 3220 msedge.exe 87 PID 3220 wrote to memory of 1420 3220 msedge.exe 87 PID 3220 wrote to memory of 1420 3220 msedge.exe 87 PID 3220 wrote to memory of 1420 3220 msedge.exe 87 PID 3220 wrote to memory of 1420 3220 msedge.exe 87 PID 3220 wrote to memory of 1420 3220 msedge.exe 87 PID 3220 wrote to memory of 1420 3220 msedge.exe 87 PID 3220 wrote to memory of 1420 3220 msedge.exe 87 PID 3220 wrote to memory of 1420 3220 msedge.exe 87 PID 3220 wrote to memory of 1420 3220 msedge.exe 87 PID 3220 wrote to memory of 1420 3220 msedge.exe 87 PID 3220 wrote to memory of 1420 3220 msedge.exe 87 PID 3220 wrote to memory of 1420 3220 msedge.exe 87 PID 3220 wrote to memory of 1420 3220 msedge.exe 87 PID 3220 wrote to memory of 1420 3220 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3e7426e33eec5574bc29823769cd6e5_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f40f46f8,0x7ff8f40f4708,0x7ff8f40f47182⤵PID:1580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,4165413257527240363,2384349482476404923,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:22⤵PID:3804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,4165413257527240363,2384349482476404923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,4165413257527240363,2384349482476404923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:82⤵PID:1420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,4165413257527240363,2384349482476404923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,4165413257527240363,2384349482476404923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,4165413257527240363,2384349482476404923,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3024 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3124
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4608
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
5KB
MD54e1e4178a28e9e822ede091fbac9781e
SHA1e6e41f6389a3a29d3249e109578ea9ee598405f1
SHA25621e1b06586010ee3d16cb9b8f140eba7f68b11c7ddc553fefb03a3e974a69478
SHA512e8aca9727271aab627e1dd5556e7a7f29977d9afe8217416ab75a00cb07700e42b4dbd8dad40bb536a225ed36711a5ef8fe226693730e5c986d30b790ef31926
-
Filesize
8KB
MD5b9f905334278521dde44c4a16659ad2e
SHA1839ecdacff0077254b4c3b4379cef3c333921d44
SHA2567bc09c64168c4ad629005569c085dd90488a02868a83f720e65d7c6bd13a10ef
SHA51233ad45635e18e0e1490552e5279810d79533f2a5bb4a92f5a769578f34d41134df45c6a87b5a7f909e74d847009df1f3ae889aec680108e86fc1ce3079a632ec