Analysis
-
max time kernel
147s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2024 04:00
Static task
static1
Behavioral task
behavioral1
Sample
76f91f6bf66b09f309142dadf730adf4_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
76f91f6bf66b09f309142dadf730adf4_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
76f91f6bf66b09f309142dadf730adf4_JaffaCakes118.html
-
Size
44KB
-
MD5
76f91f6bf66b09f309142dadf730adf4
-
SHA1
a77416febf26e547fced48b0bc1fdca0b43edaea
-
SHA256
b38b7df68a41f9ade4aa239ed2aac03f379684e7e680cedf0dca84b4c8c8f8dc
-
SHA512
febf7393cee24fd13b653c272c26f179dc996141b3bc04fa4353d611e8d7bf9d691e0ba82bf15042001592d8d489a035c44818d0cc0ae3b6d11c2af3eae5a2b6
-
SSDEEP
384:v3BplOpV+W5VM9M5NIgnlUt11Tz02XIZqNHDtz9ueKxAhUVhdypdj0PT86JabQIF:v3BpeMAIulUtPTwUjTj286JoLlWa
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1072 msedge.exe 1072 msedge.exe 312 msedge.exe 312 msedge.exe 4080 identity_helper.exe 4080 identity_helper.exe 4512 msedge.exe 4512 msedge.exe 4512 msedge.exe 4512 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe 312 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 312 wrote to memory of 636 312 msedge.exe 83 PID 312 wrote to memory of 636 312 msedge.exe 83 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 3020 312 msedge.exe 84 PID 312 wrote to memory of 1072 312 msedge.exe 85 PID 312 wrote to memory of 1072 312 msedge.exe 85 PID 312 wrote to memory of 1684 312 msedge.exe 86 PID 312 wrote to memory of 1684 312 msedge.exe 86 PID 312 wrote to memory of 1684 312 msedge.exe 86 PID 312 wrote to memory of 1684 312 msedge.exe 86 PID 312 wrote to memory of 1684 312 msedge.exe 86 PID 312 wrote to memory of 1684 312 msedge.exe 86 PID 312 wrote to memory of 1684 312 msedge.exe 86 PID 312 wrote to memory of 1684 312 msedge.exe 86 PID 312 wrote to memory of 1684 312 msedge.exe 86 PID 312 wrote to memory of 1684 312 msedge.exe 86 PID 312 wrote to memory of 1684 312 msedge.exe 86 PID 312 wrote to memory of 1684 312 msedge.exe 86 PID 312 wrote to memory of 1684 312 msedge.exe 86 PID 312 wrote to memory of 1684 312 msedge.exe 86 PID 312 wrote to memory of 1684 312 msedge.exe 86 PID 312 wrote to memory of 1684 312 msedge.exe 86 PID 312 wrote to memory of 1684 312 msedge.exe 86 PID 312 wrote to memory of 1684 312 msedge.exe 86 PID 312 wrote to memory of 1684 312 msedge.exe 86 PID 312 wrote to memory of 1684 312 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\76f91f6bf66b09f309142dadf730adf4_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb98646f8,0x7ffcb9864708,0x7ffcb98647182⤵PID:636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1796,8221463222783256162,15141683321522069333,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:22⤵PID:3020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1796,8221463222783256162,15141683321522069333,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1796,8221463222783256162,15141683321522069333,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:1684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,8221463222783256162,15141683321522069333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:1872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,8221463222783256162,15141683321522069333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1796,8221463222783256162,15141683321522069333,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:82⤵PID:3840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1796,8221463222783256162,15141683321522069333,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,8221463222783256162,15141683321522069333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:12⤵PID:3084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,8221463222783256162,15141683321522069333,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:1984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,8221463222783256162,15141683321522069333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:12⤵PID:2328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,8221463222783256162,15141683321522069333,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:12⤵PID:2040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1796,8221463222783256162,15141683321522069333,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2396 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4512
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1332
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4820
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD575c9f57baeefeecd6c184627de951c1e
SHA152e0468e13cbfc9f15fc62cc27ce14367a996cff
SHA256648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f
SHA512c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15
-
Filesize
152B
MD510fa19df148444a77ceec60cabd2ce21
SHA1685b599c497668166ede4945d8885d204fd8d70f
SHA256c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b
SHA5123518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef
-
Filesize
6KB
MD543701ae4b7f912987e61138c4acf1903
SHA174893fb665311986dcaf3803587fefb441343c1a
SHA2563c1e22fe4ee0ff75e0c9ec60c2d22f7747e15b20138d4088328b87266a33c3c5
SHA5127ac1f8a36ce259aed81602b8ff69e183845350953dd23039d0f1505f52fe7271ab518737dbcbfac4968c00ba7118d634bd068ca37868a94950a10c15b4308ee9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f76b993b-4873-47ec-8bc4-33d065cbaaa6.tmp
Filesize5KB
MD5ee695d62e1b3f92102d5b17b1f92871e
SHA161b1569bea0843013446d1c6a0522dd9f186071b
SHA2564d04d8f739e12b5a8d3b05bdcff9eb3ae6ee1906e88bf0a14dc06aa7fbcfa195
SHA5127d06bcac271644a5d1cd1fd2f0bd08fb8f45d8fa98ed246097c3ffbc010e7f00a642f213dcedfbe8e0e616c185bbb305118415c87a30329c77836de3b0fcbbeb
-
Filesize
11KB
MD57d0d2f524cde8957f20c43862bd66b67
SHA126a4578f62a6d42e94a25f0ee922b04a5883bcad
SHA2566d99257dddc2ba530e75fb05283b54f563e66066d057ebccef2e5bf1989ea01e
SHA5124a471f6ceacb87ec33b9d7fa636957bc0205ce26e5704bab9e7796ae008890e471d0483d6f7f5c68a78cb26240c11889e800212f10d21f235856ab414e35eb18