Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19-07-2024 20:40
Static task
static1
Behavioral task
behavioral1
Sample
5d9526e891c6a8eed14495eb69c10ec8_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5d9526e891c6a8eed14495eb69c10ec8_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5d9526e891c6a8eed14495eb69c10ec8_JaffaCakes118.html
-
Size
31KB
-
MD5
5d9526e891c6a8eed14495eb69c10ec8
-
SHA1
4a58ec5ecd44377905931a861b9bdb009f489c57
-
SHA256
e933773ca53ceb2fa4422187097bf443f411894f2662b8074dced2403d577b2e
-
SHA512
0545ff650bf9d68208a8fd0365f0956a05583c96cad14670b52877d64acba6fde0e3796eaa40fd8caa3c9f5503f92005879e70287d9ffb557a4f7d61bca76ebf
-
SSDEEP
768:qXKqa3VAPesJhggFwcDSlCceNrwGSLXdv9qW3qCEuX:OKqvggF9SlCceNrxSLXdv9qW6CEuX
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3468 msedge.exe 3468 msedge.exe 3368 msedge.exe 3368 msedge.exe 4624 identity_helper.exe 4624 identity_helper.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3368 wrote to memory of 1128 3368 msedge.exe 84 PID 3368 wrote to memory of 1128 3368 msedge.exe 84 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3976 3368 msedge.exe 85 PID 3368 wrote to memory of 3468 3368 msedge.exe 86 PID 3368 wrote to memory of 3468 3368 msedge.exe 86 PID 3368 wrote to memory of 3928 3368 msedge.exe 87 PID 3368 wrote to memory of 3928 3368 msedge.exe 87 PID 3368 wrote to memory of 3928 3368 msedge.exe 87 PID 3368 wrote to memory of 3928 3368 msedge.exe 87 PID 3368 wrote to memory of 3928 3368 msedge.exe 87 PID 3368 wrote to memory of 3928 3368 msedge.exe 87 PID 3368 wrote to memory of 3928 3368 msedge.exe 87 PID 3368 wrote to memory of 3928 3368 msedge.exe 87 PID 3368 wrote to memory of 3928 3368 msedge.exe 87 PID 3368 wrote to memory of 3928 3368 msedge.exe 87 PID 3368 wrote to memory of 3928 3368 msedge.exe 87 PID 3368 wrote to memory of 3928 3368 msedge.exe 87 PID 3368 wrote to memory of 3928 3368 msedge.exe 87 PID 3368 wrote to memory of 3928 3368 msedge.exe 87 PID 3368 wrote to memory of 3928 3368 msedge.exe 87 PID 3368 wrote to memory of 3928 3368 msedge.exe 87 PID 3368 wrote to memory of 3928 3368 msedge.exe 87 PID 3368 wrote to memory of 3928 3368 msedge.exe 87 PID 3368 wrote to memory of 3928 3368 msedge.exe 87 PID 3368 wrote to memory of 3928 3368 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5d9526e891c6a8eed14495eb69c10ec8_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdccaf46f8,0x7ffdccaf4708,0x7ffdccaf47182⤵PID:1128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,11286861463221380846,4135891617122930494,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:22⤵PID:3976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,11286861463221380846,4135891617122930494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,11286861463221380846,4135891617122930494,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,11286861463221380846,4135891617122930494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,11286861463221380846,4135891617122930494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:4732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,11286861463221380846,4135891617122930494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:12⤵PID:2264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2228,11286861463221380846,4135891617122930494,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5276 /prefetch:82⤵PID:2420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,11286861463221380846,4135891617122930494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:82⤵PID:2416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,11286861463221380846,4135891617122930494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,11286861463221380846,4135891617122930494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:12⤵PID:2080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,11286861463221380846,4135891617122930494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:12⤵PID:1680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,11286861463221380846,4135891617122930494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:12⤵PID:1060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,11286861463221380846,4135891617122930494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:12⤵PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,11286861463221380846,4135891617122930494,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3184 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4316
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1680
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4032
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x508 0x5281⤵PID:1964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD560f680a92a3ad45edbd25e66064fbd56
SHA10149425c9c0eaa44f159f724f62b0a9bf63480cb
SHA256485777f5a1ca2bd088c73934e70826982abb5d15880c87383568bec449fc62e4
SHA5127454b93a76e33f7ee789722376c14a2cb6a0efe3e4a27eb09a6ddaf9b45fd16e49a49475576e28de76d6e1c0d1d9513c0d48b7cbbdd1937d0d88ba78acd32905
-
Filesize
152B
MD5d406f3135e11b0a0829109c1090a41dc
SHA1810f00e803c17274f9af074fc6c47849ad6e873e
SHA25691f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4
SHA5122b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409
-
Filesize
152B
MD57f37f119665df6beaa925337bbff0e84
SHA1c2601d11f8aa77e12ab3508479cbf20c27cbd865
SHA2561073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027
SHA5128e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817
-
Filesize
1016B
MD52803cd685083be26cff03c51290ddf13
SHA100165e7dc15e73dda4402b67aa966f80fcb5884a
SHA256b14029f16696fad44802e574a8a6b866902b08a810f8db31bad45aa335429698
SHA512b32b0dd52565824de2bd846f841adb80c58125b7143a417002626767a5223222199ea795b90f951fc74f5418d2d30e51079077ccf120e0c7511965b7d4b4c647
-
Filesize
5KB
MD53e80108d6188f5938c80dff2b188173e
SHA172114cbceaccdeec4ee59566d726a27ca20956af
SHA256b5030d930aec3da7da6d2afa8a08d136e1432cd323f6032a2b2380afc46d35eb
SHA5126bde3e196d4c95108edb58e0cd8e70b66d4a3d64b903a330711e307e7a09b4743857ac70a6184d1ee84dcb56b082ca1756133b52c7a7db4e9ef0f11425017d58
-
Filesize
6KB
MD54d1671250ffc18239ef8ef53a44557bd
SHA17b19c775439f05a53de2bdfdb559de64d89e2b69
SHA2563196ed84b9231442f4a74268f7d51e35b1b68735db6859d6012136779c6da954
SHA512a8875f76d4a68c3720fcc417cd919857a9d29eb80b925aeb1435261823bec07538655a8cfaa985022636fcbee289f54989264d5d6a51d3583594bf04e1f3344f
-
Filesize
6KB
MD586ae579336f81485828afd5fc481581a
SHA1cf1f866313616c07e268733afb77040b111d59ba
SHA25698e7732d025410c25c1be21588b55ab3e5472402e2040bbfed76552a8d4e7ba7
SHA5126c6d647347a27c17de38ce9067c665a3168f12b48f853111feb6fcb045499f0cade0845f15c779930aa6584460587c1b44dad2f4c33a9004fcbd95c84909362a
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145