Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 05:48
Static task
static1
Behavioral task
behavioral1
Sample
049544f0ca2751074dc20221e8dcffae_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
049544f0ca2751074dc20221e8dcffae_JaffaCakes118.html
Resource
win10v2004-20240910-en
General
-
Target
049544f0ca2751074dc20221e8dcffae_JaffaCakes118.html
-
Size
142KB
-
MD5
049544f0ca2751074dc20221e8dcffae
-
SHA1
b604d656188680eb62f24fe328235c0208a114ad
-
SHA256
725b2f43549a9d05f136a14c1a1c2f06e74070b2c9b26acca1e687bf7092c04f
-
SHA512
fcd3e95fd924c033912490a510ebe621fbb6f3acb1dfce11967c7bcce30e323c56c7b910c6ed8c895661368c867e8be0a9180a6a1c0cea3a944afd7bd8ee06cc
-
SSDEEP
1536:SmcaBk/eCGx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:SDeLx7dyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1280 msedge.exe 1280 msedge.exe 2872 msedge.exe 2872 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2872 msedge.exe 2872 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe 2872 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2872 wrote to memory of 1120 2872 msedge.exe 84 PID 2872 wrote to memory of 1120 2872 msedge.exe 84 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 3032 2872 msedge.exe 85 PID 2872 wrote to memory of 1280 2872 msedge.exe 86 PID 2872 wrote to memory of 1280 2872 msedge.exe 86 PID 2872 wrote to memory of 3428 2872 msedge.exe 87 PID 2872 wrote to memory of 3428 2872 msedge.exe 87 PID 2872 wrote to memory of 3428 2872 msedge.exe 87 PID 2872 wrote to memory of 3428 2872 msedge.exe 87 PID 2872 wrote to memory of 3428 2872 msedge.exe 87 PID 2872 wrote to memory of 3428 2872 msedge.exe 87 PID 2872 wrote to memory of 3428 2872 msedge.exe 87 PID 2872 wrote to memory of 3428 2872 msedge.exe 87 PID 2872 wrote to memory of 3428 2872 msedge.exe 87 PID 2872 wrote to memory of 3428 2872 msedge.exe 87 PID 2872 wrote to memory of 3428 2872 msedge.exe 87 PID 2872 wrote to memory of 3428 2872 msedge.exe 87 PID 2872 wrote to memory of 3428 2872 msedge.exe 87 PID 2872 wrote to memory of 3428 2872 msedge.exe 87 PID 2872 wrote to memory of 3428 2872 msedge.exe 87 PID 2872 wrote to memory of 3428 2872 msedge.exe 87 PID 2872 wrote to memory of 3428 2872 msedge.exe 87 PID 2872 wrote to memory of 3428 2872 msedge.exe 87 PID 2872 wrote to memory of 3428 2872 msedge.exe 87 PID 2872 wrote to memory of 3428 2872 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\049544f0ca2751074dc20221e8dcffae_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa714146f8,0x7ffa71414708,0x7ffa714147182⤵PID:1120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5928496106601300255,13000336099382956132,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:3032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,5928496106601300255,13000336099382956132,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,5928496106601300255,13000336099382956132,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:82⤵PID:3428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5928496106601300255,13000336099382956132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:3788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5928496106601300255,13000336099382956132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5928496106601300255,13000336099382956132,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4980 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5076
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3900
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57006aacd11b992cd29fca21e619e86ea
SHA1f224b726a114d4c73d7379236739d5fbb8e7f7b7
SHA2563c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814
SHA5126de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d
-
Filesize
152B
MD5b80cf20d9e8cf6a579981bfaab1bdce2
SHA1171a886be3a882bd04206295ce7f1db5b8b7035e
SHA25610d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1
SHA5120233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a
-
Filesize
5KB
MD5730a707922b8f40508771ad664ec998b
SHA1e821bcce364a2cd83d854773269a7e30b2fd8558
SHA256f0be6106b1e16ebce836161d3e472d38451d070b4606c04bb77e3aa629b74bf4
SHA512708881c82faf753d79c7c2d0aab62334bbf20d6ba7e13a07d0749e58dcb222d2139efda873cbeb615fe230951b4fbe131e33a740eef3449fdaa8c483e607c598
-
Filesize
6KB
MD57300f8c4cb3179cd3f713be31472e7ac
SHA19a5d7237a47ccbf02068bd37403a6b317b00409e
SHA2569bf72663990398da7902d61a5b529d5ee5737f3f39c91206abdab2ae5120b032
SHA512a9503ab66e6db77fce198effe64268d98a50de6ab5201d67ed830d3c9cab4abe40e71d544d4ab522215dea9f0c94a0d7050a6b56b8fcbd60c3d78c9ed6718dd6
-
Filesize
10KB
MD56e7e01644ffb2a9b6801f7a4d1b7ec4d
SHA1833b7b8ce220f21cbe1776fb12ac912ae653b17a
SHA256f5dab5195ccaf70a12f2708c81e95223c1ca2d4f1cf5dea722e815b1d983855b
SHA512ed82ae0675e58e4831ad74b636818f7fd0c3209d175be7a48927a5f56912bc64d1807b7da15693b1b7e2b92c39cd6cb2609b47b7db57f34de4be79129f0a9db0