Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 09:29
Static task
static1
Behavioral task
behavioral1
Sample
6704f8fdece96f14e2f89e2861834202_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6704f8fdece96f14e2f89e2861834202_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
6704f8fdece96f14e2f89e2861834202_JaffaCakes118.html
-
Size
17KB
-
MD5
6704f8fdece96f14e2f89e2861834202
-
SHA1
1d8453087055bd590f928590a014414b7eed11f7
-
SHA256
2d5bc3983840245458cc792e939217f06d16393953add7a8dcfe9b4f0f3ea9d0
-
SHA512
7a2cde97ebc0004bd992b334168d18b7315a818909c771defcf515588f73a5c19945fdb6fe7db450f12fe80942687e65d9fd7b33f4dc94e65cf65c32ef558916
-
SSDEEP
384:rMlIcytf4puGTHjGJQBBUKiGJO/gbBLOXguLZ:8DGvGkglExLZ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2176 msedge.exe 2176 msedge.exe 1100 msedge.exe 1100 msedge.exe 1388 identity_helper.exe 1388 identity_helper.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe 1100 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1100 wrote to memory of 1964 1100 msedge.exe 84 PID 1100 wrote to memory of 1964 1100 msedge.exe 84 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 1768 1100 msedge.exe 85 PID 1100 wrote to memory of 2176 1100 msedge.exe 86 PID 1100 wrote to memory of 2176 1100 msedge.exe 86 PID 1100 wrote to memory of 4984 1100 msedge.exe 87 PID 1100 wrote to memory of 4984 1100 msedge.exe 87 PID 1100 wrote to memory of 4984 1100 msedge.exe 87 PID 1100 wrote to memory of 4984 1100 msedge.exe 87 PID 1100 wrote to memory of 4984 1100 msedge.exe 87 PID 1100 wrote to memory of 4984 1100 msedge.exe 87 PID 1100 wrote to memory of 4984 1100 msedge.exe 87 PID 1100 wrote to memory of 4984 1100 msedge.exe 87 PID 1100 wrote to memory of 4984 1100 msedge.exe 87 PID 1100 wrote to memory of 4984 1100 msedge.exe 87 PID 1100 wrote to memory of 4984 1100 msedge.exe 87 PID 1100 wrote to memory of 4984 1100 msedge.exe 87 PID 1100 wrote to memory of 4984 1100 msedge.exe 87 PID 1100 wrote to memory of 4984 1100 msedge.exe 87 PID 1100 wrote to memory of 4984 1100 msedge.exe 87 PID 1100 wrote to memory of 4984 1100 msedge.exe 87 PID 1100 wrote to memory of 4984 1100 msedge.exe 87 PID 1100 wrote to memory of 4984 1100 msedge.exe 87 PID 1100 wrote to memory of 4984 1100 msedge.exe 87 PID 1100 wrote to memory of 4984 1100 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6704f8fdece96f14e2f89e2861834202_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff876c946f8,0x7ff876c94708,0x7ff876c947182⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,17278164818315071839,14759472120529816891,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,17278164818315071839,14759472120529816891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,17278164818315071839,14759472120529816891,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:82⤵PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17278164818315071839,14759472120529816891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:2620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17278164818315071839,14759472120529816891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:1084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17278164818315071839,14759472120529816891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:12⤵PID:1524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,17278164818315071839,14759472120529816891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:82⤵PID:4156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,17278164818315071839,14759472120529816891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17278164818315071839,14759472120529816891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:12⤵PID:1428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17278164818315071839,14759472120529816891,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:12⤵PID:2116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17278164818315071839,14759472120529816891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4368 /prefetch:12⤵PID:3844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17278164818315071839,14759472120529816891,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:12⤵PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,17278164818315071839,14759472120529816891,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2776 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4816
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1644
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3424
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51f9d180c0bcf71b48e7bc8302f85c28f
SHA1ade94a8e51c446383dc0a45edf5aad5fa20edf3c
SHA256a17d56c41d524453a78e3f06e0d0b0081e79d090a4b75d0b693ddbc39f6f7fdc
SHA512282863df0e51288049587886ed37ad1cf5b6bfeed86454ea3b9f2bb7f0a1c591f3540c62712ebfcd6f1095e1977446dd5b13b904bb52b6d5c910a1efc208c785
-
Filesize
152B
MD560ead4145eb78b972baf6c6270ae6d72
SHA1e71f4507bea5b518d9ee9fb2d523c5a11adea842
SHA256b9e99e7387a915275e8fe4ac0b0c0cd330b4632814d5c9c446beb2755f1309a7
SHA5128cdbafd2783048f5f54f22e13f6ef890936d5b986b0bb3fa86d2420a5bfecf7bedc56f46e6d5f126eae79f492315843c134c441084b912296e269f384a73ccde
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD54bfd184585df9e1d43aa1005b69b26b6
SHA15f8d09f83ad1ed906438b78a12af6b1bcb328fc7
SHA256b48c2a5ca5c226b9b89b0a16169a053d937f360cb52f13c0bb16204fb34d5c7a
SHA51289b3526510b025c9ee498e85b05c73cbf3aaddd206936b08cdacf8ff586ba1b6398d1c7e80506712ec5fec1626745794d5ec8bb93f7f968eea7ca7ae0f36b8ef
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD51eb913cd61b4996803f971787436b4b4
SHA1ed4919a4b5e82d0924dd2a7847b3228f32e71213
SHA25689f6c526f29b360234b3cd0dd7af242e034c4d31a114366aef51d57e8e7e0ab5
SHA512517f6656c033f78a644e54f0385fe89d03a36a3e36f133443b0d3c16dcf5ae4142b07e19cadb648966e4dc2212caef1abc4f8478ad7e6ab3e22fc6c5520d66c7
-
Filesize
6KB
MD54291566c2e106a9cc0c1e085bd25595b
SHA1bdea69acebe118440a221cee6be26bfb9d6b2b24
SHA256b109908710bdf6ddbe58b95030984a4e608ef8316dff361c6c9daea8881ec882
SHA512ce9c714b731110c83bf6ce359a788244e2551e8bd9eba2b8121ed838524ce12d7c219157b0cb7fdcb138543f5a6f22370cbf4a94dc2c6cef2bc0526c827003ca
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5c217e747502be0d4700e5145b816713b
SHA1eb8ac0de538f3b4eaab690c2f7fcbdbf3b8f95c3
SHA256b168666ee4f94bae8970c9c043180cf2b4ad093a853a8f0f6891f8cbe66398c9
SHA512deb210dcc860d0a152b36625add7629f5835bb4a411b9fa5b8f9d56e265e8c65d4d82f0f5e8c969edd166f34e89950646a6a53af75415087a3b4ecf883b9ba64