Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2024 00:55
Static task
static1
Behavioral task
behavioral1
Sample
8269c70d6974f435c096837f9633769d_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8269c70d6974f435c096837f9633769d_JaffaCakes118.html
Resource
win10v2004-20240730-en
General
-
Target
8269c70d6974f435c096837f9633769d_JaffaCakes118.html
-
Size
32KB
-
MD5
8269c70d6974f435c096837f9633769d
-
SHA1
5d5b555f585baaf2a70aaaa1590487181ee536e2
-
SHA256
97dbe6d4ba6a20c0f609527b1b9638e2f0c8a2d2470d4bdaef0f8af55d8302bd
-
SHA512
df1c07b462a1e4c9a7f8a56bbc9edc0d41ae6ee8adf33375aa984cccdbf479868d8b7f2cf9b2ed09c1efcde27860df6258473e87214a0db0c2c05066c2651b53
-
SSDEEP
768:Zcd9QZBC7mOdMw0pC5I9nC4n5ZwxwwwJNfPd:gQZBCCOdY0IxCy5Zwxwww3fPd
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3616 msedge.exe 3616 msedge.exe 4448 msedge.exe 4448 msedge.exe 1704 identity_helper.exe 1704 identity_helper.exe 3336 msedge.exe 3336 msedge.exe 3336 msedge.exe 3336 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4448 wrote to memory of 216 4448 msedge.exe 83 PID 4448 wrote to memory of 216 4448 msedge.exe 83 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 5104 4448 msedge.exe 84 PID 4448 wrote to memory of 3616 4448 msedge.exe 85 PID 4448 wrote to memory of 3616 4448 msedge.exe 85 PID 4448 wrote to memory of 860 4448 msedge.exe 86 PID 4448 wrote to memory of 860 4448 msedge.exe 86 PID 4448 wrote to memory of 860 4448 msedge.exe 86 PID 4448 wrote to memory of 860 4448 msedge.exe 86 PID 4448 wrote to memory of 860 4448 msedge.exe 86 PID 4448 wrote to memory of 860 4448 msedge.exe 86 PID 4448 wrote to memory of 860 4448 msedge.exe 86 PID 4448 wrote to memory of 860 4448 msedge.exe 86 PID 4448 wrote to memory of 860 4448 msedge.exe 86 PID 4448 wrote to memory of 860 4448 msedge.exe 86 PID 4448 wrote to memory of 860 4448 msedge.exe 86 PID 4448 wrote to memory of 860 4448 msedge.exe 86 PID 4448 wrote to memory of 860 4448 msedge.exe 86 PID 4448 wrote to memory of 860 4448 msedge.exe 86 PID 4448 wrote to memory of 860 4448 msedge.exe 86 PID 4448 wrote to memory of 860 4448 msedge.exe 86 PID 4448 wrote to memory of 860 4448 msedge.exe 86 PID 4448 wrote to memory of 860 4448 msedge.exe 86 PID 4448 wrote to memory of 860 4448 msedge.exe 86 PID 4448 wrote to memory of 860 4448 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8269c70d6974f435c096837f9633769d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbd0446f8,0x7fffbd044708,0x7fffbd0447182⤵PID:216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,7197577970111942437,1626074250443117982,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,7197577970111942437,1626074250443117982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,7197577970111942437,1626074250443117982,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:82⤵PID:860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7197577970111942437,1626074250443117982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7197577970111942437,1626074250443117982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7197577970111942437,1626074250443117982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:12⤵PID:388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7197577970111942437,1626074250443117982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:12⤵PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7197577970111942437,1626074250443117982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:12⤵PID:2880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,7197577970111942437,1626074250443117982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:82⤵PID:772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,7197577970111942437,1626074250443117982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7197577970111942437,1626074250443117982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:12⤵PID:1864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7197577970111942437,1626074250443117982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:12⤵PID:2692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7197577970111942437,1626074250443117982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:12⤵PID:4580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7197577970111942437,1626074250443117982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:12⤵PID:2904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,7197577970111942437,1626074250443117982,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3336
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1956
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD594eddc8c760c6582645d582b4f107cca
SHA101860648fbebb62eadd53d3bc58471df3b8d211e
SHA256710d6dcbe48115aecea88b0a8c0124f5ae5f30225e59dde1bdfcc4574b5e5933
SHA5121cf9e561257755bbf563df4f348bba14ffbce2faa7cfb96738dd2aa4b166d1ddfee114578f8b84b4d7c59f3d18cadd9ebc5b45557116bf68c2eda0867d9e5484
-
Filesize
152B
MD571a22f9fe81453c6c788bfe09ab8fe0c
SHA1f4ee9368e5795c5b3f9470e0434358170e7646b6
SHA256ca6f5b89e7361282ace0d96bba28c2a4434ccecfd0a97d925e9bc61524efd908
SHA512a36d9a0c814d4293ae70a62a76e8a98e712ad91674a26cb3d8ffd300e22a6cba134e501b4a7e742229a66005db3b508aa821abcab1347b05457f06c712a1d724
-
Filesize
209KB
MD53e552d017d45f8fd93b94cfc86f842f2
SHA1dbeebe83854328e2575ff67259e3fb6704b17a47
SHA25627d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
SHA512e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize504B
MD51f8d7f9c822cfcf1f5552e08f769b64c
SHA1a5f44d61426fac7b7f6f91fdd3e39d59477f7014
SHA25614390c4a921661f102736a3dea98c47fc64061f07c49ae06e8ccce5f949e0d71
SHA512c7e76fe86712889eb363f9ddd8543c2a7834bd8a8b4aa8e9bc41cf965460ee2530165e61c8f08dd988402141d4dfd593e7f29468fac112d34921248103e40cae
-
Filesize
1KB
MD568e3215e77a2c648113fedaf6a4b036e
SHA188f23df1a7bbaf7453c65a6842f3cbd4a3eef16b
SHA256610275554f117c6b8272e0419b05a698dc93fd2d4fd997c953c3018d3815f37d
SHA512e38b35c55de593a25292557973fe5a1428c8a5484cabc76af776c20ab43a8b2465882de4476723176db900dafdea688a4bebc4e04ccc687ec26df12589771df6
-
Filesize
6KB
MD55c4981001f32dfda48e0aed92956d30d
SHA16ac7d72c87a7700a4b9fba1006888b77e48e365d
SHA2565561b441eef91fe2cab895e406962c28d06cde72590dbfd762b88815e8e0b1da
SHA512cea8ea7f8bf47d4b74d759d9ca32b1da22aa5748a1079953ca1d341784716414c931cd3cb958733ce1cccfb83cdbbddc109791a254a2ee5ed9553ce91749f45d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a2a8990c-43a9-4d3b-9acf-0eeed311ab5f.tmp
Filesize6KB
MD56a7d2a273ef06756e8894f810955c6ba
SHA17e403ec0ce1033947ad5278f88993d4dca6b6c6c
SHA2563fefd66b5671be62e61e33147ce305ecffbc145bf2f866e5328bf713dae44b98
SHA512a45717968c1d52c221bd4974dfd95259315b1b64e85a5f8bc502de21eb62149ec73a94ab5a10ca7461eea5923e3c34df1f50d757a5a4d82e775ad3de5317b537
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5f2708629dce2505dbb3d87cd9403303e
SHA13ce69f53233b39db64d4bb75ed14671c92660243
SHA25668005d23d04c9a58a1820abe910b337cf34eb091679484e124c796f840a8cf90
SHA51213cf56343e0c5d72db94611a1826380520b159700b20ef0b9591272ed33e99cef0d20c52f58b645ceb7a150e3b7d8705ee653d770c21a2a6f97bf31d2d02eb17