Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 12:43
Static task
static1
Behavioral task
behavioral1
Sample
67a4d5b717f56780c457e16d1509d357_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
67a4d5b717f56780c457e16d1509d357_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
67a4d5b717f56780c457e16d1509d357_JaffaCakes118.html
-
Size
123KB
-
MD5
67a4d5b717f56780c457e16d1509d357
-
SHA1
2de41c79dfbfcbca3c48186b820e492e63f96127
-
SHA256
4f665120312c92106e5c0485f95a7b990bf5f925fe368d065bffa0de26e85986
-
SHA512
507674d6fc6b8bcf2e0115c2bfcf50982d622174ded0ee35947cfbd83d395be59e7e79718f959e6d926b7202035c9efac9b12a87d33419f79e214cbc8fc25d96
-
SSDEEP
1536:KaaRj23EiTheiXpRENXwesCGkLYTuW2VAH:4x2U6zE6ILYt0s
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4624 msedge.exe 4624 msedge.exe 5076 msedge.exe 5076 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5076 wrote to memory of 4936 5076 msedge.exe 83 PID 5076 wrote to memory of 4936 5076 msedge.exe 83 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 408 5076 msedge.exe 84 PID 5076 wrote to memory of 4624 5076 msedge.exe 85 PID 5076 wrote to memory of 4624 5076 msedge.exe 85 PID 5076 wrote to memory of 4452 5076 msedge.exe 86 PID 5076 wrote to memory of 4452 5076 msedge.exe 86 PID 5076 wrote to memory of 4452 5076 msedge.exe 86 PID 5076 wrote to memory of 4452 5076 msedge.exe 86 PID 5076 wrote to memory of 4452 5076 msedge.exe 86 PID 5076 wrote to memory of 4452 5076 msedge.exe 86 PID 5076 wrote to memory of 4452 5076 msedge.exe 86 PID 5076 wrote to memory of 4452 5076 msedge.exe 86 PID 5076 wrote to memory of 4452 5076 msedge.exe 86 PID 5076 wrote to memory of 4452 5076 msedge.exe 86 PID 5076 wrote to memory of 4452 5076 msedge.exe 86 PID 5076 wrote to memory of 4452 5076 msedge.exe 86 PID 5076 wrote to memory of 4452 5076 msedge.exe 86 PID 5076 wrote to memory of 4452 5076 msedge.exe 86 PID 5076 wrote to memory of 4452 5076 msedge.exe 86 PID 5076 wrote to memory of 4452 5076 msedge.exe 86 PID 5076 wrote to memory of 4452 5076 msedge.exe 86 PID 5076 wrote to memory of 4452 5076 msedge.exe 86 PID 5076 wrote to memory of 4452 5076 msedge.exe 86 PID 5076 wrote to memory of 4452 5076 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\67a4d5b717f56780c457e16d1509d357_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff17fb46f8,0x7fff17fb4708,0x7fff17fb47182⤵PID:4936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16027661844649848164,11288219007631804646,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,16027661844649848164,11288219007631804646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,16027661844649848164,11288219007631804646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:82⤵PID:4452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16027661844649848164,11288219007631804646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:60
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16027661844649848164,11288219007631804646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:5036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16027661844649848164,11288219007631804646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:12⤵PID:3312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16027661844649848164,11288219007631804646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:12⤵PID:2904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16027661844649848164,11288219007631804646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:12⤵PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16027661844649848164,11288219007631804646,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4800 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2052
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3548
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1252
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56c86c838cf1dc704d2be375f04e1e6c6
SHA1ad2911a13a3addc86cc46d4329b2b1621cbe7e35
SHA256dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb
SHA512a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37
-
Filesize
152B
MD527f3335bf37563e4537db3624ee378da
SHA157543abc3d97c2a2b251b446820894f4b0111aeb
SHA256494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a
SHA5122bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485
-
Filesize
5KB
MD5b27674ab8090a286f11d0fd93e40862b
SHA110ed221bb792841e4aad19acda1c7385c948d858
SHA256f682f477c3ca620bd2db6d7c72f115c43f57401d35462dbcb9d590d813fbae74
SHA5123b69e8c54ad13b5b83547c6cd68b47fda6ac303e0d0bce89cd3f9d601bb13eae657b1b3b4eb003e6a7e104b784acda62ca53f25c881068d8a1406a5d7f8cc532
-
Filesize
6KB
MD5b7df442db96e7a58acda5e7605def80a
SHA167fce009ad715d0289db549f7dc5337faca4787d
SHA25699a7359f8c8bc6f059b4f61f257ca7cc2f6c249d73d179089de6c0cec8b2cefe
SHA5123d9279c7449234b7487a7500b7ad6b04374fda83c598d8de2c0cd30fd8dc25b121ecfb46ce5735dfad5ad9102d044913402e3642f3085d0fa3b6551f6269acfe
-
Filesize
10KB
MD57af50a808f8db7186dc6a57b365955c9
SHA15f4d078c2708471632daf23f871a6744b7836a15
SHA2567ecec4bb4b4da065283f01406b0d69519153dddac41b5785967ac9428314c8f4
SHA51208d1dcbc1d349139b760b7e9dd45446d426d6cf17e81f54109411f135e1ade2f21bcdd385e3bd64b845462c624fab294a219992015cf6b39069682da61fa1a7c