Analysis
-
max time kernel
145s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 11:49
Static task
static1
Behavioral task
behavioral1
Sample
a561f806d2a3839010f3110ba64ca129_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a561f806d2a3839010f3110ba64ca129_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a561f806d2a3839010f3110ba64ca129_JaffaCakes118.html
-
Size
116KB
-
MD5
a561f806d2a3839010f3110ba64ca129
-
SHA1
2168d2b0f24716cfcbc602f5ab946dce1d20f14e
-
SHA256
9cf054439006843bdbb0051d5cd4a6f01ff25b2829a142abb100c4b14b635fa2
-
SHA512
0899b798257f9574579ddf6a33c36af3e855dbb1a3c15bf5d4b3ad5eadcc5ded7a655b88555eaf26a83a6b3612413b4cc622c47c31aff3c88c77092272ee30f4
-
SSDEEP
1536:9IyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsQy:9IyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3220 msedge.exe 3220 msedge.exe 2124 msedge.exe 2124 msedge.exe 5080 identity_helper.exe 5080 identity_helper.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 3760 2124 msedge.exe 81 PID 2124 wrote to memory of 3760 2124 msedge.exe 81 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 812 2124 msedge.exe 82 PID 2124 wrote to memory of 3220 2124 msedge.exe 83 PID 2124 wrote to memory of 3220 2124 msedge.exe 83 PID 2124 wrote to memory of 2780 2124 msedge.exe 84 PID 2124 wrote to memory of 2780 2124 msedge.exe 84 PID 2124 wrote to memory of 2780 2124 msedge.exe 84 PID 2124 wrote to memory of 2780 2124 msedge.exe 84 PID 2124 wrote to memory of 2780 2124 msedge.exe 84 PID 2124 wrote to memory of 2780 2124 msedge.exe 84 PID 2124 wrote to memory of 2780 2124 msedge.exe 84 PID 2124 wrote to memory of 2780 2124 msedge.exe 84 PID 2124 wrote to memory of 2780 2124 msedge.exe 84 PID 2124 wrote to memory of 2780 2124 msedge.exe 84 PID 2124 wrote to memory of 2780 2124 msedge.exe 84 PID 2124 wrote to memory of 2780 2124 msedge.exe 84 PID 2124 wrote to memory of 2780 2124 msedge.exe 84 PID 2124 wrote to memory of 2780 2124 msedge.exe 84 PID 2124 wrote to memory of 2780 2124 msedge.exe 84 PID 2124 wrote to memory of 2780 2124 msedge.exe 84 PID 2124 wrote to memory of 2780 2124 msedge.exe 84 PID 2124 wrote to memory of 2780 2124 msedge.exe 84 PID 2124 wrote to memory of 2780 2124 msedge.exe 84 PID 2124 wrote to memory of 2780 2124 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a561f806d2a3839010f3110ba64ca129_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb4be046f8,0x7ffb4be04708,0x7ffb4be047182⤵PID:3760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,13605399262692061787,3299019047013793951,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:22⤵PID:812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,13605399262692061787,3299019047013793951,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,13605399262692061787,3299019047013793951,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:82⤵PID:2780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,13605399262692061787,3299019047013793951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:2872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,13605399262692061787,3299019047013793951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,13605399262692061787,3299019047013793951,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:82⤵PID:3040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,13605399262692061787,3299019047013793951,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,13605399262692061787,3299019047013793951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:12⤵PID:4384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,13605399262692061787,3299019047013793951,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:12⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,13605399262692061787,3299019047013793951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,13605399262692061787,3299019047013793951,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:12⤵PID:4676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,13605399262692061787,3299019047013793951,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1892
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3144
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dabfafd78687947a9de64dd5b776d25f
SHA116084c74980dbad713f9d332091985808b436dea
SHA256c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
SHA512dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
-
Filesize
152B
MD5c39b3aa574c0c938c80eb263bb450311
SHA1f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA25666f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
SHA512eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
-
Filesize
6KB
MD5d0bebd5f1f235a6b05866d3ea474eb75
SHA1683cdbc86cc48de8dfb7e9cfee3a6803f14bbea1
SHA2562c53815b914259fd0e12a561960747f4f710fb86dc9fa96def7d7f21cf6acaa3
SHA51249789dcb396b4a066306cc79f074edf6e72dcd65ead5945ab8107a23f6d1529156c03eaf18d9ccd3dd455be008dc54cad359ef1950a43c11266f3d94efade692
-
Filesize
6KB
MD570402d8428c64cd93ceaaf73d6a0bd91
SHA14742ace489bfcdf7a07afa99690421047beafdef
SHA256ef6c3abb3b45e365d5e90ef6ce872ab325fb97e385b0ff4683088caca129ac00
SHA512f06a41957113db8e58785b00cb77e847a1efea5ade324368bcfbc251c269b9d375c2c99e66ca050a988b46e2a099dbd53fe2a521e8d01a23a57918804737b47e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD539568d3741d47c2dd4cd082beaa4bb3d
SHA1fc45eea0babeae2a7dbf6295b277eda0078dc797
SHA25687ef245b70ac363af30e33cd28d5a7c0b7227a833010fbb8dae42c923f77284f
SHA5129c87f98ee33b4e526fdc893422ab8c34b782dd800819de05331fe08ecc52c2398328a9a83029004234c377bd25cda93a75f33f8e19190ac8eb3864cb86c0d6ae