Analysis
-
max time kernel
139s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 05:14
Static task
static1
Behavioral task
behavioral1
Sample
b1e0b8d6dcaeffa6cc07ecc2c34df089_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
b1e0b8d6dcaeffa6cc07ecc2c34df089_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
b1e0b8d6dcaeffa6cc07ecc2c34df089_JaffaCakes118.html
-
Size
156KB
-
MD5
b1e0b8d6dcaeffa6cc07ecc2c34df089
-
SHA1
acbc3f3af9e009334c5240598ed745227d583b34
-
SHA256
94c8195b3e4748949bc8e56d3ac7623e49a801d5fbf7c12cca37983e7475228e
-
SHA512
7c8006df3750825d08618abb7ed2d05015470c06a32777f7c9212226be511823e26e93a0f024801e6b9e05abb830bdace1a6df2d5eaaec5256c200b4da3faacf
-
SSDEEP
1536:iKRTvoFU7AVpzL4yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:iI5AL4yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exepid process 3792 msedge.exe 3792 msedge.exe 4892 msedge.exe 4892 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 64 identity_helper.exe 64 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4892 wrote to memory of 3664 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 3664 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2296 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 3792 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 3792 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2712 4892 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b1e0b8d6dcaeffa6cc07ecc2c34df089_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd66c246f8,0x7ffd66c24708,0x7ffd66c247182⤵PID:3664
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,7928156704893537710,3833841004018776669,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:2296
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,7928156704893537710,3833841004018776669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3792 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,7928156704893537710,3833841004018776669,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:82⤵PID:2712
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7928156704893537710,3833841004018776669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4888
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7928156704893537710,3833841004018776669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:1320
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,7928156704893537710,3833841004018776669,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1928 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2360 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,7928156704893537710,3833841004018776669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3060 /prefetch:82⤵PID:4484
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,7928156704893537710,3833841004018776669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3060 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:64 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7928156704893537710,3833841004018776669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:12⤵PID:1424
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7928156704893537710,3833841004018776669,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:12⤵PID:4744
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7928156704893537710,3833841004018776669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:12⤵PID:2240
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7928156704893537710,3833841004018776669,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:12⤵PID:4536
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4568
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD581e892ca5c5683efdf9135fe0f2adb15
SHA139159b30226d98a465ece1da28dc87088b20ecad
SHA256830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
SHA512c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
-
Filesize
152B
MD556067634f68231081c4bd5bdbfcc202f
SHA15582776da6ffc75bb0973840fc3d15598bc09eb1
SHA2568c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
SHA512c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
-
Filesize
6KB
MD5000505b8e01b1d1f9f76ee3681846668
SHA1de5b58e306f039fea6abbcce64d745d4640207dd
SHA25644ee039808b06085bb8b5ba2b5a7624484b67f4bd6cec1100cc40e847ea06874
SHA512074649c5dbd35cb9a10c451e62103205b12c6c02598431bf0d95b26ab558dc619d3144263fc1a927090d5af6226c1391a1e5c0f0e8e36fce934d4681ba1108be
-
Filesize
6KB
MD5753ba37eff53352a492557ce9a302311
SHA10e93394dd062cca4179cb44fc6c285cf6576afb9
SHA2566e52dac860fb63107eca89b3544a11d54d7f08487b18ef3f76a6e24d7ce6f9bd
SHA51249fbe5fd659fa3ce0eabf7b350e0f06b71a0693799943ac0f3ada681bcf4617984d5ed637b2892cfcb7737c7a24b63b274483fa043eb7bf1d487671e7061fa9e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5f9a2586f18e2abbc88bac75c77c540eb
SHA1d141f284e73688010653cddb0915b32921e2da8f
SHA2568103e40ec2d3135a1fc873b2a891a0ddb149c4b044fd43a8e6a784bc859a0645
SHA512f747b9292591bbf4da7f1addca9f99664b047b19a62df96bfce5bd03156b238226fef31663bb09217249fe237dfedc26ae33104584936f34dcd1da60449b9215
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e