Analysis
-
max time kernel
145s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/06/2024, 08:26
Static task
static1
Behavioral task
behavioral1
Sample
b7a4248fb6d842e3e9c18732a75fce72_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b7a4248fb6d842e3e9c18732a75fce72_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b7a4248fb6d842e3e9c18732a75fce72_JaffaCakes118.html
-
Size
55KB
-
MD5
b7a4248fb6d842e3e9c18732a75fce72
-
SHA1
6fbf67e964b2928bc9076826d6b0a0fb3c1a27e5
-
SHA256
66aec706df73c90a26be8e34da09cffb30d175b8e5cba48b69fcca9c49802f46
-
SHA512
a82b88f93716a6b9f1519fa589f148efd71f4bd14d388cbdea7b98653f76dbf09428221b93d66888763b67e8c969065c332918a64d2f968a4d2d0d99c8dbd928
-
SSDEEP
768:6gOriWNcaSo0wOHPopsg5nNrS1vNFL3/3fenDILwIP2FrhhaM2QX/Iu5djbFNvZD:l1wOgpsg5bpMRO
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1120 msedge.exe 1120 msedge.exe 3404 msedge.exe 3404 msedge.exe 1504 identity_helper.exe 1504 identity_helper.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe 912 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3404 wrote to memory of 2828 3404 msedge.exe 80 PID 3404 wrote to memory of 2828 3404 msedge.exe 80 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 4228 3404 msedge.exe 81 PID 3404 wrote to memory of 1120 3404 msedge.exe 82 PID 3404 wrote to memory of 1120 3404 msedge.exe 82 PID 3404 wrote to memory of 2256 3404 msedge.exe 83 PID 3404 wrote to memory of 2256 3404 msedge.exe 83 PID 3404 wrote to memory of 2256 3404 msedge.exe 83 PID 3404 wrote to memory of 2256 3404 msedge.exe 83 PID 3404 wrote to memory of 2256 3404 msedge.exe 83 PID 3404 wrote to memory of 2256 3404 msedge.exe 83 PID 3404 wrote to memory of 2256 3404 msedge.exe 83 PID 3404 wrote to memory of 2256 3404 msedge.exe 83 PID 3404 wrote to memory of 2256 3404 msedge.exe 83 PID 3404 wrote to memory of 2256 3404 msedge.exe 83 PID 3404 wrote to memory of 2256 3404 msedge.exe 83 PID 3404 wrote to memory of 2256 3404 msedge.exe 83 PID 3404 wrote to memory of 2256 3404 msedge.exe 83 PID 3404 wrote to memory of 2256 3404 msedge.exe 83 PID 3404 wrote to memory of 2256 3404 msedge.exe 83 PID 3404 wrote to memory of 2256 3404 msedge.exe 83 PID 3404 wrote to memory of 2256 3404 msedge.exe 83 PID 3404 wrote to memory of 2256 3404 msedge.exe 83 PID 3404 wrote to memory of 2256 3404 msedge.exe 83 PID 3404 wrote to memory of 2256 3404 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b7a4248fb6d842e3e9c18732a75fce72_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe32e546f8,0x7ffe32e54708,0x7ffe32e547182⤵PID:2828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,17881202478409293862,9233273785138766216,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:22⤵PID:4228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,17881202478409293862,9233273785138766216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,17881202478409293862,9233273785138766216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:82⤵PID:2256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,17881202478409293862,9233273785138766216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,17881202478409293862,9233273785138766216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,17881202478409293862,9233273785138766216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2448 /prefetch:12⤵PID:4480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,17881202478409293862,9233273785138766216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:82⤵PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,17881202478409293862,9233273785138766216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,17881202478409293862,9233273785138766216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:12⤵PID:1244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,17881202478409293862,9233273785138766216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:12⤵PID:544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,17881202478409293862,9233273785138766216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:12⤵PID:2880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,17881202478409293862,9233273785138766216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:12⤵PID:4684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,17881202478409293862,9233273785138766216,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4168 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:912
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1952
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
5KB
MD530c935b6ac9269a942166ce08602b61f
SHA1380c25e2df89f53f77b6589cdf194526fb4ed9da
SHA256ea812b19e1c00550f57362b70ce18f213b3983e5111e9d736070391d57d4556b
SHA512e3b388e76731a7033becd0f4eb67e235c98aaa13ab017d13f12097a7aba414fe6f11ae9d722769f1bb1d71a9f94604d32e0ff0bb207a9f444e1a1c91ed42b3f0
-
Filesize
6KB
MD5b351640d913fd6aa52af1b1b5581cc7e
SHA17cd0aca785d309f8c9ae418fd9e3b06cd2b1e78d
SHA2563998d48725db396967c98542987782c34ae951db1848e37debcb4519ceef6c29
SHA51221f6ec15f4af82c1b47e8a39e580a93b2d5d9f3781e95f14a1349eec260ec5197667265a9c1977982d80d3578a0905d6c1537e86df70160cd5268e05a322c15d
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
8KB
MD5228ef6dc058ec6eb245a30a96395c0cf
SHA1b5ad5a2cdbfcf58ec5718e5344cf20a0a0931eb4
SHA256dd01ce3c0d88c490de928815fe418efb1c1451e4866938ccd19c3003c063c397
SHA512f579a3c1621b9b527da30c456389b19dcd8f82354eac063b825e15ad66dd7556c0c640e01b3694b84c56d01815f2f5fa3e201c8eb1e9ce99e26ddf0991f1020e