Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 06:25
Static task
static1
Behavioral task
behavioral1
Sample
a43155bcffbca2ff59b6b0ca9deea153_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a43155bcffbca2ff59b6b0ca9deea153_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a43155bcffbca2ff59b6b0ca9deea153_JaffaCakes118.html
-
Size
456KB
-
MD5
a43155bcffbca2ff59b6b0ca9deea153
-
SHA1
e25d49f6616457862b9ec687e9adb867873eba9f
-
SHA256
396586d1a7939e059957cc64116f0570f32c0a247afd56725de89f89d12845cf
-
SHA512
ff6bd00a8de9faa5d51260e8bd315faf4f0aa192006ed4f3fc0afbcbe5e74cdabab90e5c961a7b9f115dd7371a38f81dbe309f753f893265ba97974988aca511
-
SSDEEP
6144:EIsMYod+X3oI+YWsMYod+X3oI+YQsMYod+X3oI+YFsMYod+X3oI+YQ:H5d+X3y5d+X3k5d+X3j5d+X3+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1924 msedge.exe 1924 msedge.exe 4788 msedge.exe 4788 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4788 msedge.exe 4788 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4788 wrote to memory of 1052 4788 msedge.exe 80 PID 4788 wrote to memory of 1052 4788 msedge.exe 80 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 3764 4788 msedge.exe 82 PID 4788 wrote to memory of 1924 4788 msedge.exe 83 PID 4788 wrote to memory of 1924 4788 msedge.exe 83 PID 4788 wrote to memory of 4072 4788 msedge.exe 84 PID 4788 wrote to memory of 4072 4788 msedge.exe 84 PID 4788 wrote to memory of 4072 4788 msedge.exe 84 PID 4788 wrote to memory of 4072 4788 msedge.exe 84 PID 4788 wrote to memory of 4072 4788 msedge.exe 84 PID 4788 wrote to memory of 4072 4788 msedge.exe 84 PID 4788 wrote to memory of 4072 4788 msedge.exe 84 PID 4788 wrote to memory of 4072 4788 msedge.exe 84 PID 4788 wrote to memory of 4072 4788 msedge.exe 84 PID 4788 wrote to memory of 4072 4788 msedge.exe 84 PID 4788 wrote to memory of 4072 4788 msedge.exe 84 PID 4788 wrote to memory of 4072 4788 msedge.exe 84 PID 4788 wrote to memory of 4072 4788 msedge.exe 84 PID 4788 wrote to memory of 4072 4788 msedge.exe 84 PID 4788 wrote to memory of 4072 4788 msedge.exe 84 PID 4788 wrote to memory of 4072 4788 msedge.exe 84 PID 4788 wrote to memory of 4072 4788 msedge.exe 84 PID 4788 wrote to memory of 4072 4788 msedge.exe 84 PID 4788 wrote to memory of 4072 4788 msedge.exe 84 PID 4788 wrote to memory of 4072 4788 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a43155bcffbca2ff59b6b0ca9deea153_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2f8546f8,0x7ffa2f854708,0x7ffa2f8547182⤵PID:1052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,3503980620422401092,13110975485020708123,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:3764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,3503980620422401092,13110975485020708123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,3503980620422401092,13110975485020708123,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:82⤵PID:4072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3503980620422401092,13110975485020708123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:2536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3503980620422401092,13110975485020708123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,3503980620422401092,13110975485020708123,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4208 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3912
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2416
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5257c0005d0c4d0bb282cb470925e4376
SHA1f9b8efb511ed64292568977c9f2ec255509e8f7d
SHA2568185c36aaacfc71e42f94fad8e198fe7fb2d868398ceabb89261cae94341cb22
SHA5122f3e8f352ed3ef88e8c28650390f93f98c92174d268330b886f3ebd1ba0163999051298ee12a054606b4986005452a241c6864cd292e69492d79c37d500556f4
-
Filesize
152B
MD54819fbc4513c82d92618f50a379ee232
SHA1ab618827ff269655283bf771fc957c8798ab51ee
SHA25605e479e8ec96b7505e01e5ec757ccfe35cb73cd46b27ff4746dce90d43d9237c
SHA512bc24fb972d04b55505101300e268f91b11e5833f1a18e925b5ded7e758b5e3e08bee1aa8f3a0b65514d6df981d0cbfa8798344db7f2a3675307df8de12ae475b
-
Filesize
5KB
MD536e6d09777166593746d289ea94a69d9
SHA18eece06927750eeee7350952dad3520c8dabe1ac
SHA256dfa34c0c08d45372f4ef50748299aef1b5c5b7578e6edf190e15436446ce6596
SHA512fcfe62bdd785a1ac5c71e98836f9c2e8005d16f22c6f8938b8ac452afb37b1d4bab460f2d4433d7ffddaea4b3a0aa71f52091ec4b9315a04e7e327ad75cb2cdf
-
Filesize
5KB
MD545e9ded6b31fe5ff2754bd77a03e892c
SHA1811362a669312884d6df3ed798cd242dc8b0c367
SHA2565da41154813da02827bf0dffc336a35ddc7b2216952673e0d40d784e25fd0ea4
SHA512e9d7f3f29049e68205c84c1209f8a21a7a0a9cef8aabc249049ac579cb55f32bdc85d6893aa595057adbbdb00bb0ab381b4450f6e1dc859d4d2ee3017e7f590a
-
Filesize
24KB
MD595cd1581c30a5c26f698a8210bcab430
SHA15e8e551a47dd682ec51a7d6808fe8e0f2af39e86
SHA256d58162c5ae5e18fc06604c285e024c01686093d70994dc93b4ae9d85b4c3f7b9
SHA512e49403df10177053634c431203a91d26df5dfb23cbbb88847459ecdf4b6107040d0944a3e84ee6bb26cb4e8017a35c8c31b658387cd1b6938ba4cb9f59606ece
-
Filesize
10KB
MD59aa8e952220382662fcb3d119e517c24
SHA18e87d77fdf1bd471dc27c7a790713a65b41db9c8
SHA256579389f84fb8262492d41db1e6246bd7bef22e5ea06ff751bffa512e8c8657a3
SHA512c383404308c6fdb641bf571813c0ccda0bd83a02596891d288ef3a8897416a3964eba0b022d04d63cfac6c3c0dff00dc68f6f064f6cd4a10cff1449c4788c653