Analysis
-
max time kernel
145s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23-08-2024 21:30
Static task
static1
Behavioral task
behavioral1
Sample
bd3a93bd2297e15d59c4a2a9dab6211b_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bd3a93bd2297e15d59c4a2a9dab6211b_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
bd3a93bd2297e15d59c4a2a9dab6211b_JaffaCakes118.html
-
Size
318B
-
MD5
bd3a93bd2297e15d59c4a2a9dab6211b
-
SHA1
1467c5e697f8cc7574b26ffede46dec01e40d132
-
SHA256
6c7443aae34b3425a498604c2a687d125f5ab87f1ccd1b4a9acc135a2061ffcd
-
SHA512
187c3b255dc43de7613981370550c4c5d1dca6ae8236bd79be9f03a35a8c9b8538fd930e5092b3f1005fb7bd36a1f2d0c1af50514dcc6d5dff3624ee7564cbcc
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2540 msedge.exe 2540 msedge.exe 1476 msedge.exe 1476 msedge.exe 2268 identity_helper.exe 2268 identity_helper.exe 796 msedge.exe 796 msedge.exe 796 msedge.exe 796 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1476 wrote to memory of 1936 1476 msedge.exe 84 PID 1476 wrote to memory of 1936 1476 msedge.exe 84 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 4196 1476 msedge.exe 85 PID 1476 wrote to memory of 2540 1476 msedge.exe 86 PID 1476 wrote to memory of 2540 1476 msedge.exe 86 PID 1476 wrote to memory of 888 1476 msedge.exe 87 PID 1476 wrote to memory of 888 1476 msedge.exe 87 PID 1476 wrote to memory of 888 1476 msedge.exe 87 PID 1476 wrote to memory of 888 1476 msedge.exe 87 PID 1476 wrote to memory of 888 1476 msedge.exe 87 PID 1476 wrote to memory of 888 1476 msedge.exe 87 PID 1476 wrote to memory of 888 1476 msedge.exe 87 PID 1476 wrote to memory of 888 1476 msedge.exe 87 PID 1476 wrote to memory of 888 1476 msedge.exe 87 PID 1476 wrote to memory of 888 1476 msedge.exe 87 PID 1476 wrote to memory of 888 1476 msedge.exe 87 PID 1476 wrote to memory of 888 1476 msedge.exe 87 PID 1476 wrote to memory of 888 1476 msedge.exe 87 PID 1476 wrote to memory of 888 1476 msedge.exe 87 PID 1476 wrote to memory of 888 1476 msedge.exe 87 PID 1476 wrote to memory of 888 1476 msedge.exe 87 PID 1476 wrote to memory of 888 1476 msedge.exe 87 PID 1476 wrote to memory of 888 1476 msedge.exe 87 PID 1476 wrote to memory of 888 1476 msedge.exe 87 PID 1476 wrote to memory of 888 1476 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bd3a93bd2297e15d59c4a2a9dab6211b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe835946f8,0x7ffe83594708,0x7ffe835947182⤵PID:1936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,12252975150315419683,4509516470992890784,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:22⤵PID:4196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,12252975150315419683,4509516470992890784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,12252975150315419683,4509516470992890784,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:82⤵PID:888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12252975150315419683,4509516470992890784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12252975150315419683,4509516470992890784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,12252975150315419683,4509516470992890784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:82⤵PID:1492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,12252975150315419683,4509516470992890784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12252975150315419683,4509516470992890784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:12⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12252975150315419683,4509516470992890784,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:12⤵PID:4504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12252975150315419683,4509516470992890784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵PID:4360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12252975150315419683,4509516470992890784,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:12⤵PID:2208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,12252975150315419683,4509516470992890784,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:796
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4032
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eeaa8087eba2f63f31e599f6a7b46ef4
SHA1f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA25650fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
SHA512eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
-
Filesize
152B
MD5b9569e123772ae290f9bac07e0d31748
SHA15806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA25620ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
SHA512cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
-
Filesize
5KB
MD5a57fa0d154b78c0f0a86f43a39e92a3f
SHA10fd651fbb964fe876c6e3eceab1e272babcd00e0
SHA25652f3b405c1934c95a4851f89290fd67f4e7a7c118be5881fac117311cc13e325
SHA512a0e6f51cf4f4c7e6dfec857f65c8833cd160e94a4b148735b896689529c2da59b18fd82b09eb34ec7aa6af309ee88c16c34b3dc799ebfd89fa5ca29060979978
-
Filesize
6KB
MD5f83681b52620b1d4e60dd6372478bdd6
SHA19fb008040e4688c5aeb11b0f85d85aa14748879a
SHA256fd5835a49d30c24c4da0c9636aa08b8e522a5e1853448db8fddad3edcd51f2cf
SHA5121242ebd93107ad652f1190f3204c9c48d753be79babca71caf7644ed5447dd3478bca5e80603ccc41079d13ddb8d86a62065cc2451ea8eaccc99679a565219ed
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD50d2221e90a3d3bb02143955ac20b034f
SHA1836e479198b7af96915042cbc6b304e4498e1874
SHA2560f9063a215ee271b83cdda63649851c1b905cace909078628b38a6c8f9a06142
SHA51232b42ea4751f03552b2041a4dfb5781724fbfabde8a4f566ee0e1636166b00fee067213f6b237ffbeb5aa239c065b3615cf93234942ac0021721cef268721744