Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 10:06
Static task
static1
Behavioral task
behavioral1
Sample
a5001c76aefbb55c38e28fa315f1f5d1_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a5001c76aefbb55c38e28fa315f1f5d1_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a5001c76aefbb55c38e28fa315f1f5d1_JaffaCakes118.html
-
Size
62KB
-
MD5
a5001c76aefbb55c38e28fa315f1f5d1
-
SHA1
d67de5a2b98f734086b2698a6f210093f9e26540
-
SHA256
df5223f8d9b651d4f6f77aaa60133ecd8ec527dd0638518465f453569a8bd2b7
-
SHA512
6cda84420da80e22a64d9c5fe61104a4d71071015bff4ec7826c7b6a0fe241a4834246639c4586218d1c7b283ee99225ca755ad3c372a09e25ab9dfcfdc54b42
-
SSDEEP
1536:zGFEUvjdxcXxvt8nzQJJtDpng+NjeGO6TPuaexm:98nzCRg+NjZO6TPue
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1932 msedge.exe 1932 msedge.exe 2552 msedge.exe 2552 msedge.exe 4528 identity_helper.exe 4528 identity_helper.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe 2552 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2552 wrote to memory of 316 2552 msedge.exe 82 PID 2552 wrote to memory of 316 2552 msedge.exe 82 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 4816 2552 msedge.exe 83 PID 2552 wrote to memory of 1932 2552 msedge.exe 84 PID 2552 wrote to memory of 1932 2552 msedge.exe 84 PID 2552 wrote to memory of 3676 2552 msedge.exe 85 PID 2552 wrote to memory of 3676 2552 msedge.exe 85 PID 2552 wrote to memory of 3676 2552 msedge.exe 85 PID 2552 wrote to memory of 3676 2552 msedge.exe 85 PID 2552 wrote to memory of 3676 2552 msedge.exe 85 PID 2552 wrote to memory of 3676 2552 msedge.exe 85 PID 2552 wrote to memory of 3676 2552 msedge.exe 85 PID 2552 wrote to memory of 3676 2552 msedge.exe 85 PID 2552 wrote to memory of 3676 2552 msedge.exe 85 PID 2552 wrote to memory of 3676 2552 msedge.exe 85 PID 2552 wrote to memory of 3676 2552 msedge.exe 85 PID 2552 wrote to memory of 3676 2552 msedge.exe 85 PID 2552 wrote to memory of 3676 2552 msedge.exe 85 PID 2552 wrote to memory of 3676 2552 msedge.exe 85 PID 2552 wrote to memory of 3676 2552 msedge.exe 85 PID 2552 wrote to memory of 3676 2552 msedge.exe 85 PID 2552 wrote to memory of 3676 2552 msedge.exe 85 PID 2552 wrote to memory of 3676 2552 msedge.exe 85 PID 2552 wrote to memory of 3676 2552 msedge.exe 85 PID 2552 wrote to memory of 3676 2552 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a5001c76aefbb55c38e28fa315f1f5d1_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbcf6b46f8,0x7ffbcf6b4708,0x7ffbcf6b47182⤵PID:316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11570648170691922067,6709539449902535465,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:4816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11570648170691922067,6709539449902535465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,11570648170691922067,6709539449902535465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:82⤵PID:3676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11570648170691922067,6709539449902535465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11570648170691922067,6709539449902535465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:12⤵PID:3092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11570648170691922067,6709539449902535465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:82⤵PID:4844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11570648170691922067,6709539449902535465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11570648170691922067,6709539449902535465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:12⤵PID:3120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11570648170691922067,6709539449902535465,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:12⤵PID:1060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11570648170691922067,6709539449902535465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:12⤵PID:3392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11570648170691922067,6709539449902535465,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:12⤵PID:1756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11570648170691922067,6709539449902535465,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5488 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3792
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2448
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5477462b6ad8eaaf8d38f5e3a4daf17b0
SHA186174e670c44767c08a39cc2a53c09c318326201
SHA256e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
SHA512a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
-
Filesize
152B
MD5b704c9ca0493bd4548ac9c69dc4a4f27
SHA1a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA2562ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
SHA51269c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
-
Filesize
6KB
MD56ddb2b6ef0591c334ebdf13b07191bd3
SHA11793e32620fb4437d9d0021b4c36430e05fa3100
SHA256b1369573e12134fc607561a1e7c9d15057e70152e5e122954736bc0d7d4719a8
SHA512648778d9598714984602e98839721ac32d8b65c32527ab641f52d8fd7d6e00f010bc6552ae48a4fcb77c4222101ddb4127c3d5dabf84599825e3e8a9cf88722c
-
Filesize
6KB
MD5255eed5d3e4b8a392ff2fa94c2bfedc7
SHA11c88430811cc02087be02e0654d1d68f671f7bad
SHA25673f17aa6cbf4084a7f735159f4cd350645b56cd88c9e7f5fa03f1dcd0b04498e
SHA5124d5dca11227829d425646b38201d170d01460e12bc9ecb62a7feeee64a4d7ed6ca9f9360dd05fa138ab6dab85d6c6c57e825a2c33a616292d1b5d9cff7a50b79
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5c144384413b37f13c03bc385a3f2ab03
SHA1fcdc621d6fb27ef435ae025f148c2c5ee4d137d0
SHA256d5ec2eae199be2b0989777c9896313392c89707b78fec561ae8318ccdfeeaa77
SHA5128bce8027a54ea666e3e8980e00e8e4d9f295fc5a4725565f9cd1ee52d9ce4b2317fb5d2611cc7c6a8b91b01cd816cc134084853e3b6226c4a5ca2b26a966c3f5