Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 06:26
Static task
static1
Behavioral task
behavioral1
Sample
a4321443bb970d6a92e5dd7887d2a1d9_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a4321443bb970d6a92e5dd7887d2a1d9_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a4321443bb970d6a92e5dd7887d2a1d9_JaffaCakes118.html
-
Size
220KB
-
MD5
a4321443bb970d6a92e5dd7887d2a1d9
-
SHA1
c4959cfdd44e9e86db67dda6372d1ba2ffeab2fd
-
SHA256
a34b547458b2f448b7f9c50bb49d3b3279599ca03e6715e2a6e73459d59489ee
-
SHA512
0013163566a1f607c8db33cf2cb1d6bcfaeb3c3dbfc5cdb7965ef407bc66773cf1d1e61797edecf684165d5e0c1fa90af3dfe31c581f5518ed062f8ade064b91
-
SSDEEP
3072:Syp3+r+zdDkzHyfkMY+BES09JXAnyrZalI+YQ:Sy0uSOsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1588 msedge.exe 1588 msedge.exe 1720 msedge.exe 1720 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe 2796 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1720 msedge.exe 1720 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1720 wrote to memory of 1352 1720 msedge.exe 81 PID 1720 wrote to memory of 1352 1720 msedge.exe 81 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 2880 1720 msedge.exe 82 PID 1720 wrote to memory of 1588 1720 msedge.exe 83 PID 1720 wrote to memory of 1588 1720 msedge.exe 83 PID 1720 wrote to memory of 452 1720 msedge.exe 84 PID 1720 wrote to memory of 452 1720 msedge.exe 84 PID 1720 wrote to memory of 452 1720 msedge.exe 84 PID 1720 wrote to memory of 452 1720 msedge.exe 84 PID 1720 wrote to memory of 452 1720 msedge.exe 84 PID 1720 wrote to memory of 452 1720 msedge.exe 84 PID 1720 wrote to memory of 452 1720 msedge.exe 84 PID 1720 wrote to memory of 452 1720 msedge.exe 84 PID 1720 wrote to memory of 452 1720 msedge.exe 84 PID 1720 wrote to memory of 452 1720 msedge.exe 84 PID 1720 wrote to memory of 452 1720 msedge.exe 84 PID 1720 wrote to memory of 452 1720 msedge.exe 84 PID 1720 wrote to memory of 452 1720 msedge.exe 84 PID 1720 wrote to memory of 452 1720 msedge.exe 84 PID 1720 wrote to memory of 452 1720 msedge.exe 84 PID 1720 wrote to memory of 452 1720 msedge.exe 84 PID 1720 wrote to memory of 452 1720 msedge.exe 84 PID 1720 wrote to memory of 452 1720 msedge.exe 84 PID 1720 wrote to memory of 452 1720 msedge.exe 84 PID 1720 wrote to memory of 452 1720 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4321443bb970d6a92e5dd7887d2a1d9_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffee9746f8,0x7fffee974708,0x7fffee9747182⤵PID:1352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,15673677488889874205,1127293282931408675,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:22⤵PID:2880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,15673677488889874205,1127293282931408675,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,15673677488889874205,1127293282931408675,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:82⤵PID:452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15673677488889874205,1127293282931408675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:3168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15673677488889874205,1127293282931408675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:12⤵PID:4936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,15673677488889874205,1127293282931408675,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2796
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3808
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5477462b6ad8eaaf8d38f5e3a4daf17b0
SHA186174e670c44767c08a39cc2a53c09c318326201
SHA256e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
SHA512a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
-
Filesize
152B
MD5b704c9ca0493bd4548ac9c69dc4a4f27
SHA1a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA2562ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
SHA51269c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
-
Filesize
6KB
MD58cf4b16a674c80944bb7fe1a336f15d5
SHA12dc7fa16fabb97b6b2276b9c92763cdf4319efc5
SHA2568488df1e0cb6f11fdb37b3f8022dbec267707b4ca0e0ab22508be80e25590e3c
SHA5127d1f8b3fe2228309d8614de57dd92d052762647603091e5fe9aa52d1f0c81ad29af3c4c7c091f2fd6803f6ddfea6d61882ae8afb328f751f2d6a3c0f2eeb57a3
-
Filesize
6KB
MD55560b207ec0a37c65a48a6ba29ef8d7d
SHA1419ef40ff7730fd23b1816563a20d4d55c1a3743
SHA256a7b65aeb321ef9daefd77da69d33177decbe34a0e001b3b58556f619efff0771
SHA512a06dd7594e8a08c33acf8f7a5bf1360a8ef014161c5a47b335e0a9e8de6d62cc607604cfc9a226fe74d90d43d62274c50bb4e7a82c54e26e5d480748e587d54e
-
Filesize
11KB
MD5f47cbb05f424064e9fc7ef93fe9f409f
SHA106e57933f3aae04a7550632762bed2e5ae940399
SHA256a629413f8b283424827c653ed0057141d4804be620996666c1a92c0abb833b07
SHA512cdb25b1ba18e7bfe64dc114efb8ae1a7bdcbad4987d88c6bb3cd57734845fa2705d23ed50c378d3cfeca90148888405d5c2b67fa99d720ec9fd98b819dde013e