Analysis
-
max time kernel
145s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 06:44
Static task
static1
Behavioral task
behavioral1
Sample
a5c5aec605eb7c3857b0583cf2f6d751_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a5c5aec605eb7c3857b0583cf2f6d751_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
a5c5aec605eb7c3857b0583cf2f6d751_JaffaCakes118.html
-
Size
15KB
-
MD5
a5c5aec605eb7c3857b0583cf2f6d751
-
SHA1
f8e34418933ac64e965f2b534ca2b880e1f6d391
-
SHA256
900dbdc56addc95cc7747d15719b34aeda63a5f6757ea884614610a4b63d48c6
-
SHA512
65c4dbd20fd1bc877ac500069b8db59209b24885c9e8a5af8e1ea72ea1e13361ba15bf64d2d6ec7f0412c81819462307a8164b8124886402d9226addc682dc28
-
SSDEEP
384:u4NcYcwrxBkP2jiwOWQnbHNxTu923r5EzC4y1DxJ2:uscYfrsP2jiwOWQn/u93zCW
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3908 msedge.exe 3908 msedge.exe 2404 msedge.exe 2404 msedge.exe 3680 identity_helper.exe 3680 identity_helper.exe 5600 msedge.exe 5600 msedge.exe 5600 msedge.exe 5600 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2404 wrote to memory of 1492 2404 msedge.exe 84 PID 2404 wrote to memory of 1492 2404 msedge.exe 84 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 1564 2404 msedge.exe 85 PID 2404 wrote to memory of 3908 2404 msedge.exe 86 PID 2404 wrote to memory of 3908 2404 msedge.exe 86 PID 2404 wrote to memory of 2200 2404 msedge.exe 87 PID 2404 wrote to memory of 2200 2404 msedge.exe 87 PID 2404 wrote to memory of 2200 2404 msedge.exe 87 PID 2404 wrote to memory of 2200 2404 msedge.exe 87 PID 2404 wrote to memory of 2200 2404 msedge.exe 87 PID 2404 wrote to memory of 2200 2404 msedge.exe 87 PID 2404 wrote to memory of 2200 2404 msedge.exe 87 PID 2404 wrote to memory of 2200 2404 msedge.exe 87 PID 2404 wrote to memory of 2200 2404 msedge.exe 87 PID 2404 wrote to memory of 2200 2404 msedge.exe 87 PID 2404 wrote to memory of 2200 2404 msedge.exe 87 PID 2404 wrote to memory of 2200 2404 msedge.exe 87 PID 2404 wrote to memory of 2200 2404 msedge.exe 87 PID 2404 wrote to memory of 2200 2404 msedge.exe 87 PID 2404 wrote to memory of 2200 2404 msedge.exe 87 PID 2404 wrote to memory of 2200 2404 msedge.exe 87 PID 2404 wrote to memory of 2200 2404 msedge.exe 87 PID 2404 wrote to memory of 2200 2404 msedge.exe 87 PID 2404 wrote to memory of 2200 2404 msedge.exe 87 PID 2404 wrote to memory of 2200 2404 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a5c5aec605eb7c3857b0583cf2f6d751_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff88fe46f8,0x7fff88fe4708,0x7fff88fe47182⤵PID:1492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,5027689847666440479,1533554192225700548,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1964 /prefetch:22⤵PID:1564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,5027689847666440479,1533554192225700548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,5027689847666440479,1533554192225700548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:82⤵PID:2200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5027689847666440479,1533554192225700548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:2564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5027689847666440479,1533554192225700548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:1772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5027689847666440479,1533554192225700548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:12⤵PID:1456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5027689847666440479,1533554192225700548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:12⤵PID:4636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5027689847666440479,1533554192225700548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:12⤵PID:2672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,5027689847666440479,1533554192225700548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:82⤵PID:4772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,5027689847666440479,1533554192225700548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5027689847666440479,1533554192225700548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:12⤵PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5027689847666440479,1533554192225700548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:12⤵PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5027689847666440479,1533554192225700548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:12⤵PID:3996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,5027689847666440479,1533554192225700548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:12⤵PID:4060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,5027689847666440479,1533554192225700548,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4160 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5600
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:60
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2700
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59b008261dda31857d68792b46af6dd6d
SHA1e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA2569ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
SHA51278853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
-
Filesize
152B
MD50446fcdd21b016db1f468971fb82a488
SHA1726b91562bb75f80981f381e3c69d7d832c87c9d
SHA25662c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
SHA5121df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
-
Filesize
209KB
MD53e552d017d45f8fd93b94cfc86f842f2
SHA1dbeebe83854328e2575ff67259e3fb6704b17a47
SHA25627d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
SHA512e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD5249d280fa35128ba4852b1836b79ca61
SHA167a6f324206ee87d586e181190281c10cc1a50bd
SHA256772d9fa5137109b3b7e125f47069cd75ecd2386098ac797897ab7334073c6ce4
SHA512f203cbcf3c0a8bb55e319b3637f8264a3d80afd3d780e05ece292e82930bdc4b664f1335c21fd8f52b03d67d9b711ef07adcc61dda619fe57201a1ba29847e1d
-
Filesize
1KB
MD5a85b835dcffde192003e4f60439a53b0
SHA1e933151727274f01ccc876ba810c891b88749024
SHA2563b58c49d82ab42f871a43b812a5b25f90c0e0d2a1f441079bfb5b818f9ca0fac
SHA5126c8d384554e2d303a81153cf74202ed3e948f156f468fa959a88f15d6453d70bb42853023aafb807b14ee0e1098134621c547769452ff163b45c154d5d5b30a9
-
Filesize
5KB
MD511554791a717604f84ba508975e4173f
SHA1ea0f8759e39486e4205dc2a3e271754ea175d56c
SHA2563f2f0ad654e386ef5184ada3da12b13713bcc78992a293400c86d82903ff64c6
SHA512c52d7bf07dc9535d2ec7dea09d9ac482016c444e198560164e709f41342594a37a224ecfd329eab5ae3a8d6b376c13dce79b7f4b674aa64a5770a6fb2bb12898
-
Filesize
6KB
MD5b800940cfe97668bf250b91127f1468b
SHA1c7a838f2f02011fb9d0ffc28aebedd4d6e87a2c1
SHA2568a1ab1257d6aa9be87cb1125e844f3f21bee3201f67b5fe3d73cabf11cc250e5
SHA512fbdabd8bc23ef03195b8ef1397b8788566068f44a0cb048d260db21ae5ef9c0277132a08c1498980d7db0026aa442ef376ae85012cd5eae8ca1c165830f97635
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5ab44646547734687f48abcda5eeb8f8e
SHA16876f68d5e79744667d9a2d36a8d8af61d899903
SHA256ccb5e5ed5466332acbad777912429a24898661a2dfeea6bca4e55e70278b0f7d
SHA5127cdc1bb2cccd337217ff243605b1b2bec5ab81a142c165bb74b0a07c9f84766cf58c9d4c0403c75015ee3de43d5e2e06934b3bf44de3c2a3f0d99ab2b1e4364d