Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 07:34
Static task
static1
Behavioral task
behavioral1
Sample
a472b54fe6337fb051ca31754469ff24_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a472b54fe6337fb051ca31754469ff24_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a472b54fe6337fb051ca31754469ff24_JaffaCakes118.html
-
Size
175KB
-
MD5
a472b54fe6337fb051ca31754469ff24
-
SHA1
8e19b473d34b24f9fd05b2858935c4947112a3c5
-
SHA256
ee687e8cab5132988304a7bd7f3df36ed57bba2d41858320211aec4c593f2bd1
-
SHA512
e9c57882079564f50efb5a34b3fa4dba1db0cc6bcc6231f4d8488467bcfc8530e4c15ea811fbcb32701003d57d4aca6b1c241151016b15e1136daca9341410ac
-
SSDEEP
1536:SqtH8gd8Wu8pI8Cd8hd8dQgbH//WoS3DGNkFqYfBCJiZOJ+aeTH+WK/Lf1/hpnV+:S9CT3D/FrBCJi5B
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1252 msedge.exe 1252 msedge.exe 3492 msedge.exe 3492 msedge.exe 1084 identity_helper.exe 1084 identity_helper.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3492 wrote to memory of 2220 3492 msedge.exe 81 PID 3492 wrote to memory of 2220 3492 msedge.exe 81 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 3220 3492 msedge.exe 82 PID 3492 wrote to memory of 1252 3492 msedge.exe 83 PID 3492 wrote to memory of 1252 3492 msedge.exe 83 PID 3492 wrote to memory of 1988 3492 msedge.exe 84 PID 3492 wrote to memory of 1988 3492 msedge.exe 84 PID 3492 wrote to memory of 1988 3492 msedge.exe 84 PID 3492 wrote to memory of 1988 3492 msedge.exe 84 PID 3492 wrote to memory of 1988 3492 msedge.exe 84 PID 3492 wrote to memory of 1988 3492 msedge.exe 84 PID 3492 wrote to memory of 1988 3492 msedge.exe 84 PID 3492 wrote to memory of 1988 3492 msedge.exe 84 PID 3492 wrote to memory of 1988 3492 msedge.exe 84 PID 3492 wrote to memory of 1988 3492 msedge.exe 84 PID 3492 wrote to memory of 1988 3492 msedge.exe 84 PID 3492 wrote to memory of 1988 3492 msedge.exe 84 PID 3492 wrote to memory of 1988 3492 msedge.exe 84 PID 3492 wrote to memory of 1988 3492 msedge.exe 84 PID 3492 wrote to memory of 1988 3492 msedge.exe 84 PID 3492 wrote to memory of 1988 3492 msedge.exe 84 PID 3492 wrote to memory of 1988 3492 msedge.exe 84 PID 3492 wrote to memory of 1988 3492 msedge.exe 84 PID 3492 wrote to memory of 1988 3492 msedge.exe 84 PID 3492 wrote to memory of 1988 3492 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a472b54fe6337fb051ca31754469ff24_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb4be046f8,0x7ffb4be04708,0x7ffb4be047182⤵PID:2220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7164093027731216734,4238160488745982490,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:22⤵PID:3220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,7164093027731216734,4238160488745982490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,7164093027731216734,4238160488745982490,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:1988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7164093027731216734,4238160488745982490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:3336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7164093027731216734,4238160488745982490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7164093027731216734,4238160488745982490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:12⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7164093027731216734,4238160488745982490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:12⤵PID:3240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7164093027731216734,4238160488745982490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:12⤵PID:1960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7164093027731216734,4238160488745982490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:12⤵PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7164093027731216734,4238160488745982490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 /prefetch:82⤵PID:4936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7164093027731216734,4238160488745982490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7164093027731216734,4238160488745982490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:12⤵PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7164093027731216734,4238160488745982490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7164093027731216734,4238160488745982490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:12⤵PID:2988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7164093027731216734,4238160488745982490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:12⤵PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7164093027731216734,4238160488745982490,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5056 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3112
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2872
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3296
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:844
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD526ceb191596251e251cd12d104b85473
SHA18af608f1f1107efd83d390cd8617e0990e3bb4d4
SHA2565d430869e990ecbaf7e22e35fc64989dc8c889ce8d1e3d2750c09c0a203a7a58
SHA512e193ccd67af868ac5f72cb1cd133591267da16bf031f59125ba8f11c35d1971b622346fb6e266894e725cb7591c14fa6ba5cff0a2b217ab57451276b216334f4
-
Filesize
152B
MD5dabfafd78687947a9de64dd5b776d25f
SHA116084c74980dbad713f9d332091985808b436dea
SHA256c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
SHA512dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
-
Filesize
152B
MD5c39b3aa574c0c938c80eb263bb450311
SHA1f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA25666f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
SHA512eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize432B
MD542328937ae6f05421e4e826538d65c21
SHA1a11f1860dc80f07ffce6fa19d872a1dfed356d40
SHA256bcd381a22533caadc3e550b4072dbc2ac592b57947e54ab1a7be8dff7beb48ac
SHA512e63289d776c29847ed4fe5636663ad8e368feab47a3314dee96acf70e3f9d761f332c48a53a36a4569ed2ebb90506a591688e0a922d08157938917a7e71e95fe
-
Filesize
2KB
MD5cfd719be4319b1878164346dd787469a
SHA1a1e1182cdaf5ae1c954b5357698f3afb78d831a1
SHA256653a7de95d2bc41f97dc443193cef0861f9a80f307a9698277f1522fac816af8
SHA512130fc3904f2e8033582b66201e9dc2b5ab03a67ac59f18d0b1fb80cb581474a6e7e226834f4882f95c52b85ea6058753eb52006b1d0cfc5903bda3988d3e0a19
-
Filesize
2KB
MD5cba7522ad485a44f88e8c54c8d6aadef
SHA13d3ad78282e7e57973d93c02ee43eb9b7a115f12
SHA2564faed60f3b19d144e1a1235063e130f5d376c533873ddcb3215e43ac63137244
SHA512dd0a5ca768a66cf2d0fd0dd9a5fcaa4494ff5def2958193b2b065fc7dcb8334fdec4f391165e7118ca0d38742897ba5c73d71bfc578f870247ae12208f86df15
-
Filesize
6KB
MD5c859d786f329c0f4a83715ef39797a02
SHA167a6ea90d11db6e343440e0df7ff1bdf9ff385a7
SHA256f915cfa2fabe40edfc419388a369ccafbd4333d2dea7fdb6c61e0f6dc4016558
SHA51293d0b56b30a00f177c79f8eea9e9c4a24120e54c39293560c5eecd41da59fff6811a414493f4196e48b0362f3faf2ca7b2195774d13457678f64cac9431d051d
-
Filesize
7KB
MD5e02fa30361bce432aacf31cdba63f943
SHA14a2349444213e73a7c3a8943de2f63671ab8d7b0
SHA2564a8b74090c54f10e4470b1af08d7d3eac3d60bb7389dd2b1b93e1a973e6afeb7
SHA51267c9eac223e95c65c1d28c804f8c70267b7f113fedbab6cb0edd6d7b7a04df0be25d41f069b6ff9c2bf705a3fe662b2926d7d0828dd219c93da3cc45e357933e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389