Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 07:36
Static task
static1
Behavioral task
behavioral1
Sample
a47490a477e7901fc6e1d17f87d26fd8_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a47490a477e7901fc6e1d17f87d26fd8_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a47490a477e7901fc6e1d17f87d26fd8_JaffaCakes118.html
-
Size
7KB
-
MD5
a47490a477e7901fc6e1d17f87d26fd8
-
SHA1
4807227bb5ee2a0dcd638dce9ac3de4b5a402aa6
-
SHA256
4002d76ee4b95eef995cb37141233c169f22140f4c21759672b56546546eff0e
-
SHA512
e915ca1042c4f0e4ded8bccdec279c212510e35ad91f1ad3544473b32618e09262b68dce0f03930324c17861b2c7a0bdb60645942f014df2343f9a571928b3b4
-
SSDEEP
48:ImMq1Up8vmbBs5k0gAiEgVr+CflxYOZAyNGWBXtz44xt5YWDrWN8zX/1sLrug2Li:SIFknf9NBXYwoIgmu5PHAnAR1dRzcRC
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 832 msedge.exe 832 msedge.exe 3544 msedge.exe 3544 msedge.exe 712 identity_helper.exe 712 identity_helper.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3544 wrote to memory of 3744 3544 msedge.exe 81 PID 3544 wrote to memory of 3744 3544 msedge.exe 81 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 4092 3544 msedge.exe 82 PID 3544 wrote to memory of 832 3544 msedge.exe 83 PID 3544 wrote to memory of 832 3544 msedge.exe 83 PID 3544 wrote to memory of 2384 3544 msedge.exe 84 PID 3544 wrote to memory of 2384 3544 msedge.exe 84 PID 3544 wrote to memory of 2384 3544 msedge.exe 84 PID 3544 wrote to memory of 2384 3544 msedge.exe 84 PID 3544 wrote to memory of 2384 3544 msedge.exe 84 PID 3544 wrote to memory of 2384 3544 msedge.exe 84 PID 3544 wrote to memory of 2384 3544 msedge.exe 84 PID 3544 wrote to memory of 2384 3544 msedge.exe 84 PID 3544 wrote to memory of 2384 3544 msedge.exe 84 PID 3544 wrote to memory of 2384 3544 msedge.exe 84 PID 3544 wrote to memory of 2384 3544 msedge.exe 84 PID 3544 wrote to memory of 2384 3544 msedge.exe 84 PID 3544 wrote to memory of 2384 3544 msedge.exe 84 PID 3544 wrote to memory of 2384 3544 msedge.exe 84 PID 3544 wrote to memory of 2384 3544 msedge.exe 84 PID 3544 wrote to memory of 2384 3544 msedge.exe 84 PID 3544 wrote to memory of 2384 3544 msedge.exe 84 PID 3544 wrote to memory of 2384 3544 msedge.exe 84 PID 3544 wrote to memory of 2384 3544 msedge.exe 84 PID 3544 wrote to memory of 2384 3544 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a47490a477e7901fc6e1d17f87d26fd8_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef34646f8,0x7ffef3464708,0x7ffef34647182⤵PID:3744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,2324089776438231642,7466956393004813476,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:22⤵PID:4092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,2324089776438231642,7466956393004813476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,2324089776438231642,7466956393004813476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:82⤵PID:2384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,2324089776438231642,7466956393004813476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:2168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,2324089776438231642,7466956393004813476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:3312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,2324089776438231642,7466956393004813476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:12⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,2324089776438231642,7466956393004813476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:82⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,2324089776438231642,7466956393004813476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,2324089776438231642,7466956393004813476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:12⤵PID:972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,2324089776438231642,7466956393004813476,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:12⤵PID:344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,2324089776438231642,7466956393004813476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:12⤵PID:1760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,2324089776438231642,7466956393004813476,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:12⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,2324089776438231642,7466956393004813476,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4236
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1124
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dabfafd78687947a9de64dd5b776d25f
SHA116084c74980dbad713f9d332091985808b436dea
SHA256c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
SHA512dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
-
Filesize
152B
MD5c39b3aa574c0c938c80eb263bb450311
SHA1f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA25666f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
SHA512eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5ede27c125dce8b1fbbe6241d286dbb47
SHA17fa84055042a04ac82dd5c95d851eb581af71882
SHA25670ba0f7e9dbdea4a050986c9c970e1d10a66d154a996c2e3e20fb82afb598502
SHA5123cf0c4259cc8b4b7ca4411039b9f09057c30d6ff23ee698d0ee1fb03d7e88dad4f5fa74104b93fa6c730e1fcb15bd4fa947361cf12c0acce7631efb83a674576
-
Filesize
6KB
MD5a80aad47b8ab62c4a63d823eaf9e91e4
SHA11ccdf292e3c762e73a69a98a74f39fc0c992f515
SHA25689d1c5ec8c5189f81f17f4abd6779bf7e2395fc6ac695977dba756379d0e7ca5
SHA512d5b1bf89afaa2d7d0693039569b2f95dfcbc92d3a9e79cd70fa1516da53d458a484aa2b0da6550ce72f8c2575712e708a5ee88050ef5f86ba58b277582135fd0
-
Filesize
6KB
MD5880e4cfd68957f26bc3b43f7d6f43c92
SHA1dd4be1ccd6e1b593be7ef86a406fc425d8e06d82
SHA2569c9c51cff954064e22d29833e56933e26f97365d65852e262e454ba45eaa3520
SHA5125912f1ec2eb18513567208c4d8951cbe560140327f8047009db762e43ef893973c63bdd1e5bd4369cf1f20690ab6826fcd408ecd49d1193bb519ee5107996c3f
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5d1e851d0a1bcacd362f512dc8005a1bf
SHA176da6bd245b19888f9bc922337ffb903fa967ffd
SHA256d1a976f9b864a4aa687e1c667aab363cbf6d608337a24c36f55b5eef76dfa8d0
SHA512f683090139b940d3a3a405f9bd8595699b4ca98de652b750c9fee77bdf4d76e01019e1448a8b7d92183fd44a5868953e57fc471a4fcf4fa84c2bb7b1384a5e8b