Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 15:51
Static task
static1
Behavioral task
behavioral1
Sample
0b6f9f41f8b931d5276cae46e9366608_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0b6f9f41f8b931d5276cae46e9366608_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
0b6f9f41f8b931d5276cae46e9366608_JaffaCakes118.html
-
Size
19KB
-
MD5
0b6f9f41f8b931d5276cae46e9366608
-
SHA1
8ecc700aaaa617df95587d24c75fc10d5a990796
-
SHA256
ce33b23d737907b53ea963c207ca56eaf4241df19d9a25da4142dc683dd980f5
-
SHA512
257c711f3d8677dbccf182fe6e03ee32dd9a876fbb3a80663ae3b395517ce557b2549d4a488383a7c1d4a162c526be3fa2e35f56f47e2b5d2c21ae72fe95652b
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIp4HzUnjBhpz82qDB8:SIMd0I5nvHZsvpoxDB8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4724 msedge.exe 4724 msedge.exe 4888 msedge.exe 4888 msedge.exe 3280 msedge.exe 3280 msedge.exe 3280 msedge.exe 3280 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4888 msedge.exe 4888 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4888 wrote to memory of 4392 4888 msedge.exe 82 PID 4888 wrote to memory of 4392 4888 msedge.exe 82 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4772 4888 msedge.exe 83 PID 4888 wrote to memory of 4724 4888 msedge.exe 84 PID 4888 wrote to memory of 4724 4888 msedge.exe 84 PID 4888 wrote to memory of 1160 4888 msedge.exe 85 PID 4888 wrote to memory of 1160 4888 msedge.exe 85 PID 4888 wrote to memory of 1160 4888 msedge.exe 85 PID 4888 wrote to memory of 1160 4888 msedge.exe 85 PID 4888 wrote to memory of 1160 4888 msedge.exe 85 PID 4888 wrote to memory of 1160 4888 msedge.exe 85 PID 4888 wrote to memory of 1160 4888 msedge.exe 85 PID 4888 wrote to memory of 1160 4888 msedge.exe 85 PID 4888 wrote to memory of 1160 4888 msedge.exe 85 PID 4888 wrote to memory of 1160 4888 msedge.exe 85 PID 4888 wrote to memory of 1160 4888 msedge.exe 85 PID 4888 wrote to memory of 1160 4888 msedge.exe 85 PID 4888 wrote to memory of 1160 4888 msedge.exe 85 PID 4888 wrote to memory of 1160 4888 msedge.exe 85 PID 4888 wrote to memory of 1160 4888 msedge.exe 85 PID 4888 wrote to memory of 1160 4888 msedge.exe 85 PID 4888 wrote to memory of 1160 4888 msedge.exe 85 PID 4888 wrote to memory of 1160 4888 msedge.exe 85 PID 4888 wrote to memory of 1160 4888 msedge.exe 85 PID 4888 wrote to memory of 1160 4888 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0b6f9f41f8b931d5276cae46e9366608_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc0da46f8,0x7ffcc0da4708,0x7ffcc0da47182⤵PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1496,6613484267648868825,692108181549284768,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:22⤵PID:4772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1496,6613484267648868825,692108181549284768,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1496,6613484267648868825,692108181549284768,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:82⤵PID:1160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,6613484267648868825,692108181549284768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,6613484267648868825,692108181549284768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:2240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1496,6613484267648868825,692108181549284768,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3280
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1452
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ecf7ca53c80b5245e35839009d12f866
SHA1a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA256882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
SHA512706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
-
Filesize
152B
MD54dd2754d1bea40445984d65abee82b21
SHA14b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA256183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
SHA51292d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
-
Filesize
5KB
MD5ed2348588c353b18a3fafd378d5180dc
SHA1725e4c41d8bcbf98ebac305df238f07272766538
SHA25652f9253dc990338cf58857d1740c46c62e8a28ddcea95e429457c9320e29b2e3
SHA5122baf2de9dd3abb46645205fa46d6425bea797aae1a001e3838eac4c181891063aad92fcac09e59955b2be92ed02a25db8cae5d36365538a322e551ddcc976a72
-
Filesize
6KB
MD5a5713a8c215942acc8ed1b1508c94e04
SHA1477e48dbb1b2feece25065358de4af3710b9591f
SHA2567a27bd72e43e0ec3b56c7106870c4e469fe2c600b8fe0a9da2b24503e3ca1c6a
SHA512f427da1316596da3024125da35f66d66cac86692c1dd30f256209f37dfa7f23225616da65e2e6efd9f60224b42ffd0f55cd51443b04cbb4a0e74df81850bbfdc
-
Filesize
6KB
MD5e5094397734aaaec3dd519d9470bcb1b
SHA1c2a68731e0ccd36d1d63f4c40d4e545bed32ab21
SHA25679605c79c4c43a6994fc90b2fa399b59b3176949204ce0f30f2402b1bd1d2f39
SHA5121e5672411c4919e0af97c6417a4922a62dd9ef11b2e67a4ce90713eb50181567083516d96dd907fffbe6d9becb8aa40cd88b72d32e8450f2db3b01437459839b
-
Filesize
10KB
MD548eb0db331189fa5c33928d2b156c844
SHA17e420fb673ffbbbae27a6316741c569dc2e833d4
SHA2569628ef80e1d5abac322acd32cf8e9464cd3f90c636d883e81b55592facaaee0a
SHA5128db405d136d29649ca62f8aee5c0e5a83623176bb49072b894f020749c8749a95e426d1094a2c9514a53d22e0c20ba20721697c24c9ca209601104af57ea896c