Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 07:14
Static task
static1
Behavioral task
behavioral1
Sample
a45fa5fcebcd616e3902995a80d4e6be_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
a45fa5fcebcd616e3902995a80d4e6be_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a45fa5fcebcd616e3902995a80d4e6be_JaffaCakes118.html
-
Size
111KB
-
MD5
a45fa5fcebcd616e3902995a80d4e6be
-
SHA1
ca485956ea5e1d975398383f9b9b5af9b2f36931
-
SHA256
b9872d457155fe0a2a76c7eac62dce4d2229e83e9ccbcf87990c55fa54bc226f
-
SHA512
ce71ffb57998db75f01a42793a07b308aad86a9647b2ef8251717ce4d86d976b6c66d9026d7e18aa5d62ba7418fa884c89b6aafacf7965a4053be5e32d322255
-
SSDEEP
1536:hPMFvuG9xI6WFpGdWzXUMpMZI+8m7srDwmOuUWAN3rVV0SSEsKE5KFdJKfJuYQjo:OMpMZ9kMpBV0SmiehuYs0Smh4P7S62
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1620 msedge.exe 1620 msedge.exe 4412 msedge.exe 4412 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 1240 identity_helper.exe 1240 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4412 wrote to memory of 376 4412 msedge.exe 81 PID 4412 wrote to memory of 376 4412 msedge.exe 81 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1188 4412 msedge.exe 82 PID 4412 wrote to memory of 1620 4412 msedge.exe 83 PID 4412 wrote to memory of 1620 4412 msedge.exe 83 PID 4412 wrote to memory of 2348 4412 msedge.exe 84 PID 4412 wrote to memory of 2348 4412 msedge.exe 84 PID 4412 wrote to memory of 2348 4412 msedge.exe 84 PID 4412 wrote to memory of 2348 4412 msedge.exe 84 PID 4412 wrote to memory of 2348 4412 msedge.exe 84 PID 4412 wrote to memory of 2348 4412 msedge.exe 84 PID 4412 wrote to memory of 2348 4412 msedge.exe 84 PID 4412 wrote to memory of 2348 4412 msedge.exe 84 PID 4412 wrote to memory of 2348 4412 msedge.exe 84 PID 4412 wrote to memory of 2348 4412 msedge.exe 84 PID 4412 wrote to memory of 2348 4412 msedge.exe 84 PID 4412 wrote to memory of 2348 4412 msedge.exe 84 PID 4412 wrote to memory of 2348 4412 msedge.exe 84 PID 4412 wrote to memory of 2348 4412 msedge.exe 84 PID 4412 wrote to memory of 2348 4412 msedge.exe 84 PID 4412 wrote to memory of 2348 4412 msedge.exe 84 PID 4412 wrote to memory of 2348 4412 msedge.exe 84 PID 4412 wrote to memory of 2348 4412 msedge.exe 84 PID 4412 wrote to memory of 2348 4412 msedge.exe 84 PID 4412 wrote to memory of 2348 4412 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a45fa5fcebcd616e3902995a80d4e6be_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff912ed46f8,0x7ff912ed4708,0x7ff912ed47182⤵PID:376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,918450418322086370,707198155701964498,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:1188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,918450418322086370,707198155701964498,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,918450418322086370,707198155701964498,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:82⤵PID:2348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,918450418322086370,707198155701964498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:2164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,918450418322086370,707198155701964498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,918450418322086370,707198155701964498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2152 /prefetch:12⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,918450418322086370,707198155701964498,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3480 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,918450418322086370,707198155701964498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:12⤵PID:1572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,918450418322086370,707198155701964498,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:12⤵PID:3988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,918450418322086370,707198155701964498,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:82⤵PID:2928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,918450418322086370,707198155701964498,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,918450418322086370,707198155701964498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:12⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,918450418322086370,707198155701964498,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1264 /prefetch:12⤵PID:3336
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2408
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
5KB
MD5c933e3cafb321eda821ae4a7db6c50b8
SHA13836cd03f25e1237ce5927c6905ce655f34bdfff
SHA256a2136d91c8cea3ba150b03c3d1672dc34b42d152d3bf99e470ecc66645c3318c
SHA512836f0684b9c687ab79ea64109c4276c65ed2ca091f2fe4afa2c053bd49ed0813140e50406c9191fc20c5fba509d789c7faffce83bc0204ddc70325b0ff22c9de
-
Filesize
6KB
MD5df130387d1f294beec553c5fd99c4691
SHA1bc818fb2745c1b29c7ee3e041f07b79b82a1a798
SHA2567e3a315a6d97b0a705e73347b4a783fc56b496e130e6cd801650d11337ad8d22
SHA5123745eea2fa7449ae589e741e3a3b89b286993160b5c14c53e855e92afeb5449fa46f2982d3d4a12b0cbf08fe15fac2ebbd034134c4c959fd672b87eb9378cf58
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD5a77820d7da77d779734af048483044c9
SHA1c445fb0e14f63bc134769f2812ec13e670514116
SHA256697537c90483138b1e754ca76d7b2f11fa6a1c83b751165296b1540b5edcd5ff
SHA5124624adc2da2e9fa2d0dbb8abd6a0c2f622b776ef762dba000ee1e6a3bc4624a1349771dfb6205c87d6e270487168d91b0ce03989c14ae0abd4a4fbd9b1dda301