Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 09:53
Static task
static1
Behavioral task
behavioral1
Sample
d416416827854887d8fc5af5e1698af3_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d416416827854887d8fc5af5e1698af3_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d416416827854887d8fc5af5e1698af3_JaffaCakes118.html
-
Size
39KB
-
MD5
d416416827854887d8fc5af5e1698af3
-
SHA1
bfd214c30df26a6b059ce79474cca12ccf30dccb
-
SHA256
be4d3ef5fbd21d3078327133f344f043053782a85b79900ac3ff3a9fc133a010
-
SHA512
e341afd92d4966caf5a0bfd1d2621dce2d8b3c9fb6e5e9530f0306841d13a43da0712349bf833b28779c7ef2beab012a9b3a2ab10470c97ae383def081d2e83b
-
SSDEEP
192:uwXgb5nJenQjxn5Q/xnQiecNnjnQOkEntnnnQTbnxnQmSixKzIhr9sMXtSiggWvf:iQ/qNx4MrcuJw/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3136 msedge.exe 3136 msedge.exe 2388 msedge.exe 2388 msedge.exe 808 identity_helper.exe 808 identity_helper.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 4168 2388 msedge.exe 83 PID 2388 wrote to memory of 4168 2388 msedge.exe 83 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 4520 2388 msedge.exe 84 PID 2388 wrote to memory of 3136 2388 msedge.exe 85 PID 2388 wrote to memory of 3136 2388 msedge.exe 85 PID 2388 wrote to memory of 1184 2388 msedge.exe 86 PID 2388 wrote to memory of 1184 2388 msedge.exe 86 PID 2388 wrote to memory of 1184 2388 msedge.exe 86 PID 2388 wrote to memory of 1184 2388 msedge.exe 86 PID 2388 wrote to memory of 1184 2388 msedge.exe 86 PID 2388 wrote to memory of 1184 2388 msedge.exe 86 PID 2388 wrote to memory of 1184 2388 msedge.exe 86 PID 2388 wrote to memory of 1184 2388 msedge.exe 86 PID 2388 wrote to memory of 1184 2388 msedge.exe 86 PID 2388 wrote to memory of 1184 2388 msedge.exe 86 PID 2388 wrote to memory of 1184 2388 msedge.exe 86 PID 2388 wrote to memory of 1184 2388 msedge.exe 86 PID 2388 wrote to memory of 1184 2388 msedge.exe 86 PID 2388 wrote to memory of 1184 2388 msedge.exe 86 PID 2388 wrote to memory of 1184 2388 msedge.exe 86 PID 2388 wrote to memory of 1184 2388 msedge.exe 86 PID 2388 wrote to memory of 1184 2388 msedge.exe 86 PID 2388 wrote to memory of 1184 2388 msedge.exe 86 PID 2388 wrote to memory of 1184 2388 msedge.exe 86 PID 2388 wrote to memory of 1184 2388 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d416416827854887d8fc5af5e1698af3_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3b0a46f8,0x7fff3b0a4708,0x7fff3b0a47182⤵PID:4168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,12338905976879852032,3385181221484032754,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:22⤵PID:4520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,12338905976879852032,3385181221484032754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,12338905976879852032,3385181221484032754,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:82⤵PID:1184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12338905976879852032,3385181221484032754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12338905976879852032,3385181221484032754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:12⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12338905976879852032,3385181221484032754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:12⤵PID:2196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12338905976879852032,3385181221484032754,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:12⤵PID:1996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,12338905976879852032,3385181221484032754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:82⤵PID:4372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,12338905976879852032,3385181221484032754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12338905976879852032,3385181221484032754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:12⤵PID:1540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12338905976879852032,3385181221484032754,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:12⤵PID:4712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,12338905976879852032,3385181221484032754,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4956 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4892
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2404
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ff63763eedb406987ced076e36ec9acf
SHA116365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA2568f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
SHA512ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
-
Filesize
152B
MD52783c40400a8912a79cfd383da731086
SHA1001a131fe399c30973089e18358818090ca81789
SHA256331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
SHA512b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
-
Filesize
5KB
MD52c5a21dcc7ba83320f1805e9c797f0d9
SHA111508f644bfab58a868862e4c1bfe13135c458eb
SHA2561744630ac8ab0af948c4fb52e740008959dff2074385cedafe499730f6065d0f
SHA5124c6876aebb70576d800df075556cdb2ce0256969999765dfab5d577f4dcc9e45cc373193e7a71ec96167e5ef62d7d4f4fd91585fed6e896113c41dac895703be
-
Filesize
6KB
MD55114fa9f77e6288e9f2ad34b119d5adf
SHA12f80d688e4b5bd741371ecefb705292845f9f12e
SHA256467001118cf670a131b1ddd2935649914aec38851ca6edd81786db46c75e654b
SHA512cc2a1808043ed154da154ec67d65f68a159201d8cfaf16a368d6f404ca75e6284bfba99ee603aac101f88fe82b1655e514cef5365db558f88069e5828afb844a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD59881bd39b8dc21689ff8b9323407c84f
SHA167041b070242ecec6dec0dddcc525f6b0fe49d2a
SHA25667f43d648d3e89ec99bc1372890e09e67b09ba07cbe74d785ceb65194dae9230
SHA512ad4a214fd8c189f0237906397d46ab3300080836a8b6e0430d33b0d4e5a723e079c291049814f828dfb681b7c500d8033b0ca208982707d131731ddaf4485377