Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 13:32
Static task
static1
Behavioral task
behavioral1
Sample
a5cd85fe8aad9766fb5990bb71feae64_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a5cd85fe8aad9766fb5990bb71feae64_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a5cd85fe8aad9766fb5990bb71feae64_JaffaCakes118.html
-
Size
13KB
-
MD5
a5cd85fe8aad9766fb5990bb71feae64
-
SHA1
9c07246cf55797f727ef1cf9289797292e9d75ed
-
SHA256
018146af06ac65b9578e2d216808c2ddc4a040434fb6c5f915c402b144d1a39d
-
SHA512
867149008880029595d52d195384e656976da192cf16b09c680cafa5a643c0efb9911344d3e8a119dcb872a85c60e4e5e540c98459a1c4300ab5ed85704709f9
-
SSDEEP
384:CyifTe/ayTAQFAi7hy1wSPMy25/1x9MpPNWIB:CyiqQQFAi7hIRMp1xmPko
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 452 msedge.exe 452 msedge.exe 3700 msedge.exe 3700 msedge.exe 1404 identity_helper.exe 1404 identity_helper.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe 1204 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3700 wrote to memory of 3228 3700 msedge.exe 82 PID 3700 wrote to memory of 3228 3700 msedge.exe 82 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 4944 3700 msedge.exe 84 PID 3700 wrote to memory of 452 3700 msedge.exe 85 PID 3700 wrote to memory of 452 3700 msedge.exe 85 PID 3700 wrote to memory of 1008 3700 msedge.exe 86 PID 3700 wrote to memory of 1008 3700 msedge.exe 86 PID 3700 wrote to memory of 1008 3700 msedge.exe 86 PID 3700 wrote to memory of 1008 3700 msedge.exe 86 PID 3700 wrote to memory of 1008 3700 msedge.exe 86 PID 3700 wrote to memory of 1008 3700 msedge.exe 86 PID 3700 wrote to memory of 1008 3700 msedge.exe 86 PID 3700 wrote to memory of 1008 3700 msedge.exe 86 PID 3700 wrote to memory of 1008 3700 msedge.exe 86 PID 3700 wrote to memory of 1008 3700 msedge.exe 86 PID 3700 wrote to memory of 1008 3700 msedge.exe 86 PID 3700 wrote to memory of 1008 3700 msedge.exe 86 PID 3700 wrote to memory of 1008 3700 msedge.exe 86 PID 3700 wrote to memory of 1008 3700 msedge.exe 86 PID 3700 wrote to memory of 1008 3700 msedge.exe 86 PID 3700 wrote to memory of 1008 3700 msedge.exe 86 PID 3700 wrote to memory of 1008 3700 msedge.exe 86 PID 3700 wrote to memory of 1008 3700 msedge.exe 86 PID 3700 wrote to memory of 1008 3700 msedge.exe 86 PID 3700 wrote to memory of 1008 3700 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a5cd85fe8aad9766fb5990bb71feae64_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeba3b46f8,0x7ffeba3b4708,0x7ffeba3b47182⤵PID:3228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,11784275876885932173,17909149317780220037,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,11784275876885932173,17909149317780220037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,11784275876885932173,17909149317780220037,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:82⤵PID:1008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11784275876885932173,17909149317780220037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:2132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11784275876885932173,17909149317780220037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:2784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,11784275876885932173,17909149317780220037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:82⤵PID:3460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,11784275876885932173,17909149317780220037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11784275876885932173,17909149317780220037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:12⤵PID:3828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11784275876885932173,17909149317780220037,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:12⤵PID:2984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11784275876885932173,17909149317780220037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:12⤵PID:1852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11784275876885932173,17909149317780220037,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:12⤵PID:352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,11784275876885932173,17909149317780220037,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2308 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1204
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5080
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dabfafd78687947a9de64dd5b776d25f
SHA116084c74980dbad713f9d332091985808b436dea
SHA256c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
SHA512dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
-
Filesize
152B
MD5c39b3aa574c0c938c80eb263bb450311
SHA1f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA25666f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
SHA512eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
-
Filesize
6KB
MD568dabf24f73f9bab4fb228333969cd74
SHA1738362366df4d9a46605fd0af0464b3c1b3f7774
SHA256a7528e06ec36a4380dda3a02c15b6fb3ea6df277c6ffdae24edc4ea2c184eaa3
SHA5122aa7640b78de6f1050cca64e6067b581aa74d212f0d704868937e1e8875f25390999f1b2eabdcbdf80ad0363449cd4be15176cdb8f6aa9816a826ad9acb8e912
-
Filesize
6KB
MD54688e410b05b6e4345ae27bd4e2f9641
SHA19cc96bd6dbfb8bca8b5d6ba624a12bf60fab7246
SHA2563852b19e5aa3aac26e205b13652c09a69f9e8dff77cc373ea19c280efe9be1e8
SHA5127304b0082ab0517008fdef2319ba85601e95c9b5e5bf16c462833dd1c280ab88cb2669a57c0a1986fbb6447a6e155172a67aa81e892520ffd5cf9406a831d2ed
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5fbbefb7ebafef4345a63ea50a2252b42
SHA1f2ec4f7f9de2e512e6e881a458959ecf453d3b1a
SHA256653c804c62cc41c011a67b5a04e2a6f1066f27f36a4f170b40844350e00a2c66
SHA5127913b16cb7f9fe9e67569b21d2a310ef9716a82708dbc665434654b85987b6fa2f0b39847b56705e517d4b359bf61fd2284f942c670dd8ddec6971c912907c7f