Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
16/07/2024, 05:26
Static task
static1
Behavioral task
behavioral1
Sample
4cf900b983040dc261753e96ab088896_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4cf900b983040dc261753e96ab088896_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4cf900b983040dc261753e96ab088896_JaffaCakes118.html
-
Size
123KB
-
MD5
4cf900b983040dc261753e96ab088896
-
SHA1
51c1974e90f45957dac5a7d1bbf1f2bec56f4a33
-
SHA256
45a02e672d17f4f19df7b407f6eb45ddd909ce71e1ba0243d1c18a3b2c9ce27d
-
SHA512
4b8a0c965968c8e23107e0aa7bb72ba3a161f54a81772f469eedf3605fa1952694c0d41cb7166f995a7d1e55660add3c03ba4d89e74f75fdce89615963e5536e
-
SSDEEP
1536:22KEji17agLcOystBYvo+96NcCWD+H/QgQ7XyhaZm5:wEjQaqteLEiy1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1172 msedge.exe 1172 msedge.exe 4316 msedge.exe 4316 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe 3212 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4316 wrote to memory of 4548 4316 msedge.exe 83 PID 4316 wrote to memory of 4548 4316 msedge.exe 83 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 4644 4316 msedge.exe 84 PID 4316 wrote to memory of 1172 4316 msedge.exe 85 PID 4316 wrote to memory of 1172 4316 msedge.exe 85 PID 4316 wrote to memory of 3172 4316 msedge.exe 86 PID 4316 wrote to memory of 3172 4316 msedge.exe 86 PID 4316 wrote to memory of 3172 4316 msedge.exe 86 PID 4316 wrote to memory of 3172 4316 msedge.exe 86 PID 4316 wrote to memory of 3172 4316 msedge.exe 86 PID 4316 wrote to memory of 3172 4316 msedge.exe 86 PID 4316 wrote to memory of 3172 4316 msedge.exe 86 PID 4316 wrote to memory of 3172 4316 msedge.exe 86 PID 4316 wrote to memory of 3172 4316 msedge.exe 86 PID 4316 wrote to memory of 3172 4316 msedge.exe 86 PID 4316 wrote to memory of 3172 4316 msedge.exe 86 PID 4316 wrote to memory of 3172 4316 msedge.exe 86 PID 4316 wrote to memory of 3172 4316 msedge.exe 86 PID 4316 wrote to memory of 3172 4316 msedge.exe 86 PID 4316 wrote to memory of 3172 4316 msedge.exe 86 PID 4316 wrote to memory of 3172 4316 msedge.exe 86 PID 4316 wrote to memory of 3172 4316 msedge.exe 86 PID 4316 wrote to memory of 3172 4316 msedge.exe 86 PID 4316 wrote to memory of 3172 4316 msedge.exe 86 PID 4316 wrote to memory of 3172 4316 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4cf900b983040dc261753e96ab088896_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaed8a46f8,0x7ffaed8a4708,0x7ffaed8a47182⤵PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3169418268910646430,17115114447090430417,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,3169418268910646430,17115114447090430417,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,3169418268910646430,17115114447090430417,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:3172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3169418268910646430,17115114447090430417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3169418268910646430,17115114447090430417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:1648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3169418268910646430,17115114447090430417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:12⤵PID:3064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3169418268910646430,17115114447090430417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:12⤵PID:1156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3169418268910646430,17115114447090430417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2476 /prefetch:12⤵PID:1516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3169418268910646430,17115114447090430417,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3212
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1780
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5584971c8ba88c824fd51a05dddb45a98
SHA1b7c9489b4427652a9cdd754d1c1b6ac4034be421
SHA256e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307
SHA5125dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726
-
Filesize
152B
MD5b28ef7d9f6d74f055cc49876767c886c
SHA1d6b3267f36c340979f8fc3e012fdd02c468740bf
SHA256fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37
SHA512491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD5dcb0491c707a917344a4521c3a1e2199
SHA174cb75756ed4fb737c74b401f1d6a2e350448ab7
SHA256918228ffe5c6766653be97ba82ce27797bf6f4520054f0b8d0d16302e877a98d
SHA512ca381dafd2f7f69a1a01f3d73d7f64bcd42ada33cbc556add0d34c79e9b97b938636d085726744cffb05580a27ff2a64d304b90cd6ab5b153c54095afdbbd8d4
-
Filesize
6KB
MD535973ff971a80fc60e29f7fb98285e8a
SHA14e02bc3fa64026a16b4c0d31f9d89455d6000365
SHA2568b8099bee613575a8a49960f3b253fd9b80ae4e5abf05c9eb65ab908e715ee8d
SHA512a5c0305e3e7ecc9de31214d4cacc99ef4ea616737a8d61dbca55516cb90df28c6b2fa25dd9d6d602405faa0aea8c4578febe64c4a9fbdede65b64c4abc370d7d
-
Filesize
11KB
MD57ece0072c02fa7e37e0e1bf5fa6dc698
SHA1058cd6ed5b5f63b23ee2e6cbd1e931f7f9992f2b
SHA2565f7c849beb4ef230ee2d7b16ea49451f29b1129703504224701e091984b807b9
SHA51247443a3e61e94e8a2a19386f764fa300a21bda80fed55e99c5ded5f494edb467c09fa99d2710e4d74d9894e971aadc5bafb5b4c07b4701b4360d9a7872b69ee5