Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26-08-2024 04:15
Static task
static1
Behavioral task
behavioral1
Sample
c243b52bb7b64bb61cb3dbe6a2589603_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c243b52bb7b64bb61cb3dbe6a2589603_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c243b52bb7b64bb61cb3dbe6a2589603_JaffaCakes118.html
-
Size
74KB
-
MD5
c243b52bb7b64bb61cb3dbe6a2589603
-
SHA1
295b687ffe277db4972947a1f23793843c5edb59
-
SHA256
870951fa43558a4b54f40acf047fee94d726440baba12510ec129ee2bf4ffea6
-
SHA512
6db2b6857be5651daf43b9f7359d810202933b3d4e75bb71e0848af35b2ea0766165fdd85aceabb61a92370b188c57f64d6100ff671952a4628cd261790bba1d
-
SSDEEP
1536:bfyyL5SXlvVp/whenL6JuCw46TrRsHPlWaYdxkt6FC6g1/:bfyJpYgtgHdWaY3FC6g1/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1176 msedge.exe 1176 msedge.exe 3400 msedge.exe 3400 msedge.exe 3608 identity_helper.exe 3608 identity_helper.exe 2096 msedge.exe 2096 msedge.exe 2096 msedge.exe 2096 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe 3400 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3400 wrote to memory of 4436 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 4436 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2024 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 1176 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 1176 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe PID 3400 wrote to memory of 2528 3400 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c243b52bb7b64bb61cb3dbe6a2589603_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc8c046f8,0x7ffdc8c04708,0x7ffdc8c047182⤵PID:4436
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:2024
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1176 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:82⤵PID:2528
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:4964
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:3692
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:12⤵PID:568
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:82⤵PID:388
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3608 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:12⤵PID:4344
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:12⤵PID:1624
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:12⤵PID:1348
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:12⤵PID:4556
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2816 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2096
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4608
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2332
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e4f80e7950cbd3bb11257d2000cb885e
SHA110ac643904d539042d8f7aa4a312b13ec2106035
SHA2561184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
SHA5122b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
-
Filesize
152B
MD52dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA256dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
SHA512682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD54207281cebba251c786ef72dd5274b7b
SHA19dcaf472b6bc8a153a16e6118d9877841338dafe
SHA256c7c12916d0cafa64d3dae32b50089dc180cd6cb221319c45cd1a7377342db94b
SHA512c7dc96479ca5ed57cd27773348d79f881ae751ca61073deb8dc65c8ad235957f311acbb07d9caed76455888ac6fc1dd6f5a54c292a59a2a6f9d48784dce934dd
-
Filesize
1KB
MD5394e8d1519b22af34791ed740eaf1ad4
SHA19ac9d461090eaebd3600cd3a7a3d6a9e801cf84f
SHA2569539df58858f0ed97c84b2537c926ac6ec3f1e0dcda1babfb97297844c75aea8
SHA512e3eb03049092fd07258c5c45fb7ecb9f7194759a6d5eb1334133c754f031230eebf5fe6ec3cac9d73eff0c7329d15cc701154472c174bf70068fdd47896e7490
-
Filesize
5KB
MD59a84258bf8283a51676f51abe5c84bdc
SHA1a7e506ffae44566c14076fe9643a85756fe587b5
SHA2563412a84c73b10890b03d4d340925d85ab96244d63f036dcaf355fb907688c351
SHA512076478600aaed6db4c00d54d81a96954144eb315aac74eab9f93749e100323db5ede259165953ff540bca017fb8e61f53e929b018dea2ed75b1105571676b664
-
Filesize
7KB
MD5507241ed9634586e31c69a9ce505dc36
SHA167b887846358f2516e7731e195b0d1cfecbeb595
SHA25644d069354d9f2c0d7df586d49438a449e68aa302c026b05edbbaf653e3fc21da
SHA512b0816f8177652f8ae421a4670353132f9e441db17130a5641a9cc46ae1a4a951cd24f69bdc25ed23e8d8afa1e7d4d211e4f8748ba9391d3f99272582435ddd4c
-
Filesize
7KB
MD514c7e10896af594b8374f62fad6eb5e2
SHA1f50a0776d47b8a32d677dd7a43bcbc6b12621d33
SHA25689877bbdc0cc810b9f14da625dca4b5c032735094a881d906a28670ec74ba534
SHA5122e7551b25d9bf2fe8ba6f7eba9761ee77d12e7e4bad2aff50bffc870b72165452cb899e3fe0bd157499dab4900d1615d61abfdd77743024ae5ce38b017c15df1
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5f1537b13c525982775ed91fb11ab110a
SHA108957c3ec940c08d2bf0cbf93bbe950501b725a6
SHA2567572ce5272bb6f4d32d1e16b582a9c84bf983372f7f2333c2916632591a5907e
SHA51243037b7f2bf27bf3e02c1c510c639bc244d17d277c0035379cd9f5745010d3e7344c8c8429e534a57efbafbc8d48bc4bf35fd799de1e8a6ae32f31ebbf607364
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e