Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 04:53
Static task
static1
Behavioral task
behavioral1
Sample
771f8b05f9de44a5b7376a0ec9c44b66_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
771f8b05f9de44a5b7376a0ec9c44b66_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
771f8b05f9de44a5b7376a0ec9c44b66_JaffaCakes118.html
-
Size
12KB
-
MD5
771f8b05f9de44a5b7376a0ec9c44b66
-
SHA1
6457fd5dd1c059b21f36eb563745a0278411a38c
-
SHA256
49a2398c92b00b67af9d973aed9a56767c703d85d37f3b5401d4430074381820
-
SHA512
0b2438a79f6ae6e291891e234531f162083af06fa3d4d5b8657095f9c698e1b7352601bf49da7937936e7e4a64baf66c82907039202c9dbaf9889d21ece85e60
-
SSDEEP
192:2VBGlIsr0KXyJtVCkN5G78k/w1whqJk1YB3Z/nNYeFy01y5uBuLbdU8d:sslIc0VvjGt/g6YB3Z/nNYeFy0y5guLZ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1180 msedge.exe 1180 msedge.exe 2040 msedge.exe 2040 msedge.exe 3044 msedge.exe 3044 msedge.exe 3044 msedge.exe 3044 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2040 wrote to memory of 1892 2040 msedge.exe 84 PID 2040 wrote to memory of 1892 2040 msedge.exe 84 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 3680 2040 msedge.exe 85 PID 2040 wrote to memory of 1180 2040 msedge.exe 86 PID 2040 wrote to memory of 1180 2040 msedge.exe 86 PID 2040 wrote to memory of 868 2040 msedge.exe 87 PID 2040 wrote to memory of 868 2040 msedge.exe 87 PID 2040 wrote to memory of 868 2040 msedge.exe 87 PID 2040 wrote to memory of 868 2040 msedge.exe 87 PID 2040 wrote to memory of 868 2040 msedge.exe 87 PID 2040 wrote to memory of 868 2040 msedge.exe 87 PID 2040 wrote to memory of 868 2040 msedge.exe 87 PID 2040 wrote to memory of 868 2040 msedge.exe 87 PID 2040 wrote to memory of 868 2040 msedge.exe 87 PID 2040 wrote to memory of 868 2040 msedge.exe 87 PID 2040 wrote to memory of 868 2040 msedge.exe 87 PID 2040 wrote to memory of 868 2040 msedge.exe 87 PID 2040 wrote to memory of 868 2040 msedge.exe 87 PID 2040 wrote to memory of 868 2040 msedge.exe 87 PID 2040 wrote to memory of 868 2040 msedge.exe 87 PID 2040 wrote to memory of 868 2040 msedge.exe 87 PID 2040 wrote to memory of 868 2040 msedge.exe 87 PID 2040 wrote to memory of 868 2040 msedge.exe 87 PID 2040 wrote to memory of 868 2040 msedge.exe 87 PID 2040 wrote to memory of 868 2040 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\771f8b05f9de44a5b7376a0ec9c44b66_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea4b446f8,0x7ffea4b44708,0x7ffea4b447182⤵PID:1892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,1268021424190164206,2492721857869918827,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:3680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,1268021424190164206,2492721857869918827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,1268021424190164206,2492721857869918827,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:82⤵PID:868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1268021424190164206,2492721857869918827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:4956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1268021424190164206,2492721857869918827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:2732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1268021424190164206,2492721857869918827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:12⤵PID:468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,1268021424190164206,2492721857869918827,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3044
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1084
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eaaad45aced1889a90a8aa4c39f92659
SHA15c0130d9e8d1a64c97924090d9a5258b8a31b83c
SHA2565e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b
SHA5120db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4
-
Filesize
152B
MD53ee50fb26a9d3f096c47ff8696c24321
SHA1a8c83e798d2a8b31fec0820560525e80dfa4fe66
SHA256d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f
SHA512479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD574a7669ff30cbc87fba8be5fff486cbb
SHA1b3052e73246c1c90805143b18253d16dd3efe614
SHA256101a2cf286f132bc236d1f15aaaac58e3a6002aa21147cce85776360ecc987e4
SHA512e16ff237d0f99405b662e3c11f4bad7e618b1872ef0c1b92b1070b97be0b33cc0c8b35a0d4f3028a896225a83804aced1b02d0f78257647a57037fb5886ac237
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD5233a634109d83f682d321563b3838ece
SHA1f6ef95c58043b06ec03efbbdcdabf70b857f213f
SHA25640bd1f8210eb471573a57945d21a79a3725524fbb577e63f1b1153da69f99831
SHA512e83c346ab6a66b5996dd2fbf84fc467cc27ee7a6b9c974357120964f3294682e0358a5d772ef4392e45729927dc7a6da558cfc01ff77ec9d2267dd77c42102e2
-
Filesize
6KB
MD5aa7010607b906b91b5976160d1a2c88c
SHA129ffc4d1e19af3116326c1589a177d5e9364a4b6
SHA256dfffbc46dec7f00c1f99341f3b8d5373e67d55bdb53a63b54de3f2b4e34518af
SHA512b1dc7e12275c77df27f9660253f5bf1b568bb19028d9c4393f01237559f618399fc062a8cd8577db25b4c434104d4d4ddc6a0a43ea448f318fcc84c42805b874
-
Filesize
10KB
MD5b47ac764c4a202dd93ae233ae559645b
SHA178592f64794ade97c33efb2d708d46d3dd485a49
SHA256bc6b100e615f339aa69f7f6595f02a31f3da2be48fbd49c41aae43b445f25cc0
SHA51225a0741c56b0a08fec4c38128a86627156b4e11f26802aee5068e370e9b417985deaef1b600ef2557a0d67a6f8249438bdbd8f05499205659532f8535ef61897