Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 10:08
Static task
static1
Behavioral task
behavioral1
Sample
a5029cc55b4e2cb09995def01c22c422_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a5029cc55b4e2cb09995def01c22c422_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a5029cc55b4e2cb09995def01c22c422_JaffaCakes118.html
-
Size
69KB
-
MD5
a5029cc55b4e2cb09995def01c22c422
-
SHA1
9428791e6e2e1d8a97254721a108c94af64d67a7
-
SHA256
6a321af571a723493e95cf2318555b3d3db718927ca88b6da54e0ca19f01c460
-
SHA512
c0d40807c276a43833a4333c8e9755377d8f7de0746821bc97fb680dedc299609cf9058e414b72c8165a456d27d91e8eadc9174da2213d56135a91faf93cd491
-
SSDEEP
768:JibgcMWR3sI2PDDnd0g6sd9djeHdGoTyZ1wCZkoTyMdtbBnfBgN8/lboiGhcRoQS:JJaRTSNen0tbrga90hcJNnspv
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3500 msedge.exe 3500 msedge.exe 3040 msedge.exe 3040 msedge.exe 2624 identity_helper.exe 2624 identity_helper.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 1332 3040 msedge.exe 80 PID 3040 wrote to memory of 1332 3040 msedge.exe 80 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 2068 3040 msedge.exe 81 PID 3040 wrote to memory of 3500 3040 msedge.exe 82 PID 3040 wrote to memory of 3500 3040 msedge.exe 82 PID 3040 wrote to memory of 2540 3040 msedge.exe 83 PID 3040 wrote to memory of 2540 3040 msedge.exe 83 PID 3040 wrote to memory of 2540 3040 msedge.exe 83 PID 3040 wrote to memory of 2540 3040 msedge.exe 83 PID 3040 wrote to memory of 2540 3040 msedge.exe 83 PID 3040 wrote to memory of 2540 3040 msedge.exe 83 PID 3040 wrote to memory of 2540 3040 msedge.exe 83 PID 3040 wrote to memory of 2540 3040 msedge.exe 83 PID 3040 wrote to memory of 2540 3040 msedge.exe 83 PID 3040 wrote to memory of 2540 3040 msedge.exe 83 PID 3040 wrote to memory of 2540 3040 msedge.exe 83 PID 3040 wrote to memory of 2540 3040 msedge.exe 83 PID 3040 wrote to memory of 2540 3040 msedge.exe 83 PID 3040 wrote to memory of 2540 3040 msedge.exe 83 PID 3040 wrote to memory of 2540 3040 msedge.exe 83 PID 3040 wrote to memory of 2540 3040 msedge.exe 83 PID 3040 wrote to memory of 2540 3040 msedge.exe 83 PID 3040 wrote to memory of 2540 3040 msedge.exe 83 PID 3040 wrote to memory of 2540 3040 msedge.exe 83 PID 3040 wrote to memory of 2540 3040 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a5029cc55b4e2cb09995def01c22c422_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9903a46f8,0x7ff9903a4708,0x7ff9903a47182⤵PID:1332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,8833957402193913543,6169340138359122260,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:2068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,8833957402193913543,6169340138359122260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,8833957402193913543,6169340138359122260,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:82⤵PID:2540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8833957402193913543,6169340138359122260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8833957402193913543,6169340138359122260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:5096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,8833957402193913543,6169340138359122260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4372 /prefetch:82⤵PID:408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,8833957402193913543,6169340138359122260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4372 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8833957402193913543,6169340138359122260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:12⤵PID:4236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8833957402193913543,6169340138359122260,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:12⤵PID:532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8833957402193913543,6169340138359122260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:12⤵PID:5064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8833957402193913543,6169340138359122260,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:12⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,8833957402193913543,6169340138359122260,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5288 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1892
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2760
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
5KB
MD588fcf5d777d524b36085bc3f84d90e3a
SHA13a6ba930af15e2d8b034d44e5143246b6f12d60b
SHA2562d2bc7fd3133b8059efc329990f7355ae1eecf17bb66aa40c1f3194aaca93066
SHA512323c8b3e0753d8c0220b788c9c266ec032c5c922b04e8437f79a98265e15e7a86bb837afd34791b1c2a33e5ab8fc89012db2933fde2af5637b0973764439b489
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD5a3a66daae6be74fece2dbca9f281f200
SHA1e53427f6768e163916d7330d562149166e67602c
SHA256eef7ed39ecbc9d2481b46b62c473a3a75abcfffc978cf672f417ab183c59f700
SHA5129ef95517a477b00dd390ae5a593159e55b7dde1460a84e8822f89e663d80075b0b0a2feb358105f269b7088c504f858b24e679a1af9b6bdfd5c588260d0be99a