Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 06:19
Static task
static1
Behavioral task
behavioral1
Sample
a42badc8b99f1ae5b12d8ad0e973c449_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a42badc8b99f1ae5b12d8ad0e973c449_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a42badc8b99f1ae5b12d8ad0e973c449_JaffaCakes118.html
-
Size
31KB
-
MD5
a42badc8b99f1ae5b12d8ad0e973c449
-
SHA1
c92da6f8bf4281ff0e6ca313df4cdab07c249308
-
SHA256
4a1238cabe84d66cf5bc34eb748a697082bef63660c22f76d24e648adacf4118
-
SHA512
eb08d0603fc98810159c1312e5fe66cc0988dfc063d45289c53368bd709b1c37279a7d4e4758a6c19cd1b212720eb72b533c52b7961f2f28b371415f42b13801
-
SSDEEP
384:Srd/mscacHcicTc6c+YSrHx84JNliFzY0OCa5K2yPk2dd7+2U:S9pmr0xVrO4JniVYz5K27O7i
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4800 msedge.exe 4800 msedge.exe 3144 msedge.exe 3144 msedge.exe 1948 identity_helper.exe 1948 identity_helper.exe 4676 msedge.exe 4676 msedge.exe 4676 msedge.exe 4676 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3144 wrote to memory of 4820 3144 msedge.exe 82 PID 3144 wrote to memory of 4820 3144 msedge.exe 82 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 1652 3144 msedge.exe 83 PID 3144 wrote to memory of 4800 3144 msedge.exe 84 PID 3144 wrote to memory of 4800 3144 msedge.exe 84 PID 3144 wrote to memory of 4472 3144 msedge.exe 85 PID 3144 wrote to memory of 4472 3144 msedge.exe 85 PID 3144 wrote to memory of 4472 3144 msedge.exe 85 PID 3144 wrote to memory of 4472 3144 msedge.exe 85 PID 3144 wrote to memory of 4472 3144 msedge.exe 85 PID 3144 wrote to memory of 4472 3144 msedge.exe 85 PID 3144 wrote to memory of 4472 3144 msedge.exe 85 PID 3144 wrote to memory of 4472 3144 msedge.exe 85 PID 3144 wrote to memory of 4472 3144 msedge.exe 85 PID 3144 wrote to memory of 4472 3144 msedge.exe 85 PID 3144 wrote to memory of 4472 3144 msedge.exe 85 PID 3144 wrote to memory of 4472 3144 msedge.exe 85 PID 3144 wrote to memory of 4472 3144 msedge.exe 85 PID 3144 wrote to memory of 4472 3144 msedge.exe 85 PID 3144 wrote to memory of 4472 3144 msedge.exe 85 PID 3144 wrote to memory of 4472 3144 msedge.exe 85 PID 3144 wrote to memory of 4472 3144 msedge.exe 85 PID 3144 wrote to memory of 4472 3144 msedge.exe 85 PID 3144 wrote to memory of 4472 3144 msedge.exe 85 PID 3144 wrote to memory of 4472 3144 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a42badc8b99f1ae5b12d8ad0e973c449_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd168946f8,0x7ffd16894708,0x7ffd168947182⤵PID:4820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,17678476571020343631,4159753699804004407,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:22⤵PID:1652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,17678476571020343631,4159753699804004407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,17678476571020343631,4159753699804004407,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:82⤵PID:4472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17678476571020343631,4159753699804004407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:4256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17678476571020343631,4159753699804004407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:4460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,17678476571020343631,4159753699804004407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:82⤵PID:1656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,17678476571020343631,4159753699804004407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17678476571020343631,4159753699804004407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:12⤵PID:2696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17678476571020343631,4159753699804004407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:12⤵PID:1588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17678476571020343631,4159753699804004407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:12⤵PID:1500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17678476571020343631,4159753699804004407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:3204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,17678476571020343631,4159753699804004407,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4456 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4676
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2108
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1324
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
5KB
MD5b4998dda3257c8b2036825789860252e
SHA150a33420f0c77637ae1274c9247f566dbf1e4894
SHA25657d286580bc5567c7b36f38871b832e408be6fa230159c1ecf26f4129b9bb6c9
SHA512551d5504e1f44a502429c2e628418d6789d57ded5df9748924f64b261d4634f73a3e1d773637f52e3f4365dc8c58b1203d7b0bfa1f0368d2e9a837111e1643cb
-
Filesize
6KB
MD5d1209a591af5e78cca5370d5881fc1e5
SHA1aadac344172e20a878c148902da576ada02b6038
SHA2564525e0207bd624889faf16ba383f20302f3e5b4ae51e0c62f811884c66d0c426
SHA512516038b57f54f4f6084ab33d3a70f2d4c5856c0d1e426cc8fc664c8b855eddc50d610145fbc1821c0b13e2f5904c2d31fa24f9a4bca8cc2ff335fe61defe3b85
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD5f8c6933b2b6ab9e8b5550e3f9d668bc3
SHA138b646e43c8a3e483557f365892856545c5d695c
SHA256a33ff8859e7a1946687a7e2eb49d50d7c54642a0e10f7b7994f9b209808b73ef
SHA512acd9b0d33b19eb01905726a32554283ed69228df2b72a72a36e01143eaf29dce6ae5bc62eb557abd1570e34ed66b769a4f3ab6e690d5fa8c2a3f2150470cbf2b