Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 06:24
Static task
static1
Behavioral task
behavioral1
Sample
a43034ec71f6255c77ee7df06048128c_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a43034ec71f6255c77ee7df06048128c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a43034ec71f6255c77ee7df06048128c_JaffaCakes118.html
-
Size
93KB
-
MD5
a43034ec71f6255c77ee7df06048128c
-
SHA1
80da5f50f1d2038cba2dfe99806bfb87a57cf86c
-
SHA256
caa4335b761ff6f3c8f32a2d171efd6ca111867c1ce955c593959e33dbe611bb
-
SHA512
f99add6e9bcb875798a83113792ea75e12b894d70cc64c94207610c47085ccb62dc9498e7de4d9cf288e2d38d75ebe9d7d3c8261ab42c3ef1b86c24d8c67e3cd
-
SSDEEP
1536:tyCcYktcjIr5FbynzS+iEfPHqZljQAE9etKVYvyKR5XeB8waAGBNR:UCcYktcx2BNR
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3316 msedge.exe 3316 msedge.exe 2276 msedge.exe 2276 msedge.exe 1508 identity_helper.exe 1508 identity_helper.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe 2276 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2276 wrote to memory of 560 2276 msedge.exe 82 PID 2276 wrote to memory of 560 2276 msedge.exe 82 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3504 2276 msedge.exe 83 PID 2276 wrote to memory of 3316 2276 msedge.exe 84 PID 2276 wrote to memory of 3316 2276 msedge.exe 84 PID 2276 wrote to memory of 1828 2276 msedge.exe 85 PID 2276 wrote to memory of 1828 2276 msedge.exe 85 PID 2276 wrote to memory of 1828 2276 msedge.exe 85 PID 2276 wrote to memory of 1828 2276 msedge.exe 85 PID 2276 wrote to memory of 1828 2276 msedge.exe 85 PID 2276 wrote to memory of 1828 2276 msedge.exe 85 PID 2276 wrote to memory of 1828 2276 msedge.exe 85 PID 2276 wrote to memory of 1828 2276 msedge.exe 85 PID 2276 wrote to memory of 1828 2276 msedge.exe 85 PID 2276 wrote to memory of 1828 2276 msedge.exe 85 PID 2276 wrote to memory of 1828 2276 msedge.exe 85 PID 2276 wrote to memory of 1828 2276 msedge.exe 85 PID 2276 wrote to memory of 1828 2276 msedge.exe 85 PID 2276 wrote to memory of 1828 2276 msedge.exe 85 PID 2276 wrote to memory of 1828 2276 msedge.exe 85 PID 2276 wrote to memory of 1828 2276 msedge.exe 85 PID 2276 wrote to memory of 1828 2276 msedge.exe 85 PID 2276 wrote to memory of 1828 2276 msedge.exe 85 PID 2276 wrote to memory of 1828 2276 msedge.exe 85 PID 2276 wrote to memory of 1828 2276 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a43034ec71f6255c77ee7df06048128c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa72446f8,0x7fffa7244708,0x7fffa72447182⤵PID:560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1484,7807788044194886978,10130680509836993140,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:22⤵PID:3504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1484,7807788044194886978,10130680509836993140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1484,7807788044194886978,10130680509836993140,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:1828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1484,7807788044194886978,10130680509836993140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:5064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1484,7807788044194886978,10130680509836993140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1484,7807788044194886978,10130680509836993140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 /prefetch:82⤵PID:4988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1484,7807788044194886978,10130680509836993140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1484,7807788044194886978,10130680509836993140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:12⤵PID:4264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1484,7807788044194886978,10130680509836993140,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:12⤵PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1484,7807788044194886978,10130680509836993140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:12⤵PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1484,7807788044194886978,10130680509836993140,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:12⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1484,7807788044194886978,10130680509836993140,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1316 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:544
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1692
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
5KB
MD5a7ac968ecc11b8b4f541d32988d08e27
SHA118c35d625d83870caa82c9e2eaad76e5501f6bb9
SHA25699e71324fa8566aa53d77a9f6191c68be64bb77f41ddea1841b752ab9d8ca813
SHA51207fad363886eeff38d6446cb6a305b9c7ca7381a293db3d19fc0f5ddcb1de418475e35ba17a9b748491ab70f8c0d47c07c5bd093408f25638e7d64947f489049
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
8KB
MD52c8c89fcc2297bc3afe608f20c4bb2e6
SHA1e044ab6c48ab45f5c90c6aaa38484079e5e9f270
SHA256a3f128a05a9bd69a7f4f3efb39c9576d359e17b6f7352bea68a457498c3da312
SHA5123a5e2b8db87134f286949f1ae2e068d31142a165ab4adee36b196e967fb2b3e8cfeacfcb19dbd42722506b28deb79ae7d815a8ebe644b286c9b46b369a06d647