Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 23:50
Static task
static1
Behavioral task
behavioral1
Sample
36e6954c4324ba0aebbe0f1f8426b4f3_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
36e6954c4324ba0aebbe0f1f8426b4f3_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
36e6954c4324ba0aebbe0f1f8426b4f3_JaffaCakes118.html
-
Size
116KB
-
MD5
36e6954c4324ba0aebbe0f1f8426b4f3
-
SHA1
29682952cb5db306b27ec193a2c82d466a86232b
-
SHA256
3427a96eeb698345c7d5374fe565cb3a00a935ad0d099647891a826d4641e8a2
-
SHA512
5c63f751109c0eedcc6aba60d71da284e8429595ef03b341810a1e6bf9eabb1be0cad0f659db57a5b92738fec103cffbf84b1a5c8a199126d889ea3fe5feb2ce
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fcvnMHAm5nLxTn18cZCVNdTp:srvVLT8b
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4500 msedge.exe 4500 msedge.exe 1592 msedge.exe 1592 msedge.exe 1176 msedge.exe 1176 msedge.exe 1176 msedge.exe 1176 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1592 msedge.exe 1592 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1592 wrote to memory of 3892 1592 msedge.exe 83 PID 1592 wrote to memory of 3892 1592 msedge.exe 83 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 1312 1592 msedge.exe 84 PID 1592 wrote to memory of 4500 1592 msedge.exe 85 PID 1592 wrote to memory of 4500 1592 msedge.exe 85 PID 1592 wrote to memory of 1828 1592 msedge.exe 86 PID 1592 wrote to memory of 1828 1592 msedge.exe 86 PID 1592 wrote to memory of 1828 1592 msedge.exe 86 PID 1592 wrote to memory of 1828 1592 msedge.exe 86 PID 1592 wrote to memory of 1828 1592 msedge.exe 86 PID 1592 wrote to memory of 1828 1592 msedge.exe 86 PID 1592 wrote to memory of 1828 1592 msedge.exe 86 PID 1592 wrote to memory of 1828 1592 msedge.exe 86 PID 1592 wrote to memory of 1828 1592 msedge.exe 86 PID 1592 wrote to memory of 1828 1592 msedge.exe 86 PID 1592 wrote to memory of 1828 1592 msedge.exe 86 PID 1592 wrote to memory of 1828 1592 msedge.exe 86 PID 1592 wrote to memory of 1828 1592 msedge.exe 86 PID 1592 wrote to memory of 1828 1592 msedge.exe 86 PID 1592 wrote to memory of 1828 1592 msedge.exe 86 PID 1592 wrote to memory of 1828 1592 msedge.exe 86 PID 1592 wrote to memory of 1828 1592 msedge.exe 86 PID 1592 wrote to memory of 1828 1592 msedge.exe 86 PID 1592 wrote to memory of 1828 1592 msedge.exe 86 PID 1592 wrote to memory of 1828 1592 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\36e6954c4324ba0aebbe0f1f8426b4f3_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd24f546f8,0x7ffd24f54708,0x7ffd24f547182⤵PID:3892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,8316167441938724126,4759814124997343040,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:1312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,8316167441938724126,4759814124997343040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,8316167441938724126,4759814124997343040,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:82⤵PID:1828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8316167441938724126,4759814124997343040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:2680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8316167441938724126,4759814124997343040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:12⤵PID:1496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,8316167441938724126,4759814124997343040,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1328 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1176
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2676
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2212
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5bafce9e4c53a0cb85310891b6b21791b
SHA15d70027cc137a7cbb38f5801b15fd97b05e89ee2
SHA25671fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00
SHA512c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c
-
Filesize
152B
MD5a499254d6b5d91f97eb7a86e5f8ca573
SHA103dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1
SHA256fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499
SHA512d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c
-
Filesize
6KB
MD5644f1baf9a924da0e4c67e5cc087cdab
SHA1e916134f153f5b44ba24c003f13134256381fb77
SHA2563a4a8e26e4e8bb6eac36904e081f3c7c16fc69cc2d11bf7d77f0dd9fa67b419a
SHA512685e2720aa59bf4f4d9166d428f0d2a3e218706b69836746e1beef1c63eb2e51469799c8b19335bbff54ca972719704512f5261a4bd1e53fe28a997e3591b6a8
-
Filesize
6KB
MD52db359cf092b81108c736d9d8a74f5e9
SHA1447c053808fcccbbac7ea43940f482200ee27776
SHA2560f5f093381d57bc5d94c3b2c0b8d1c37a1eb9ca83b1d8916c2287bbcb37340ed
SHA51298dd7d1b01786dd12ef6b677f6809e510fd91e956bb4c7a84ece93f9d3e6f7f465c01a5789544601f95b3ee8165d931a3bb1e1f814adf0622a7417bb2aa83f6e
-
Filesize
11KB
MD5a628d73ffede48647617f7ef92963897
SHA1aeceefc4a48edac4927169ccf0e64aeab9611a89
SHA25616976dbc383892e0eea56d9ca69d1c398778bb13abc57eebcaae1086f8642aef
SHA5122f9dc59f7eb0745731d2c3c76c66be57dac3c3fcc45ef4b46b5bea67d554b9496426aafe2591a05bb2d09d1f3ff2bb802de51781d496bbbcd3364b1897910d6a