Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 16:07
Static task
static1
Behavioral task
behavioral1
Sample
0f87bb117f4ea22f7b0d71095379e8e4_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0f87bb117f4ea22f7b0d71095379e8e4_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
0f87bb117f4ea22f7b0d71095379e8e4_JaffaCakes118.html
-
Size
214KB
-
MD5
0f87bb117f4ea22f7b0d71095379e8e4
-
SHA1
578aadd53ed8d33b0e939f491589b8cc44f7a89b
-
SHA256
9716ad1220d028a8d533979a3166327782578ed69bc440a059d69c501123e6ac
-
SHA512
08378a1efcf1b6304cac40fb4ec2592b73901d0754361beec80bb7db5e4cff22eeea875e4c8749618d994bedc43e184700131b48ec92e9405258aeceabfb1a4f
-
SSDEEP
3072:wrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJj:oz9VxLY7iAVLTBQJlj
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3380 msedge.exe 3380 msedge.exe 2092 msedge.exe 2092 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2092 msedge.exe 2092 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2092 wrote to memory of 1280 2092 msedge.exe 82 PID 2092 wrote to memory of 1280 2092 msedge.exe 82 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3412 2092 msedge.exe 83 PID 2092 wrote to memory of 3380 2092 msedge.exe 84 PID 2092 wrote to memory of 3380 2092 msedge.exe 84 PID 2092 wrote to memory of 4224 2092 msedge.exe 85 PID 2092 wrote to memory of 4224 2092 msedge.exe 85 PID 2092 wrote to memory of 4224 2092 msedge.exe 85 PID 2092 wrote to memory of 4224 2092 msedge.exe 85 PID 2092 wrote to memory of 4224 2092 msedge.exe 85 PID 2092 wrote to memory of 4224 2092 msedge.exe 85 PID 2092 wrote to memory of 4224 2092 msedge.exe 85 PID 2092 wrote to memory of 4224 2092 msedge.exe 85 PID 2092 wrote to memory of 4224 2092 msedge.exe 85 PID 2092 wrote to memory of 4224 2092 msedge.exe 85 PID 2092 wrote to memory of 4224 2092 msedge.exe 85 PID 2092 wrote to memory of 4224 2092 msedge.exe 85 PID 2092 wrote to memory of 4224 2092 msedge.exe 85 PID 2092 wrote to memory of 4224 2092 msedge.exe 85 PID 2092 wrote to memory of 4224 2092 msedge.exe 85 PID 2092 wrote to memory of 4224 2092 msedge.exe 85 PID 2092 wrote to memory of 4224 2092 msedge.exe 85 PID 2092 wrote to memory of 4224 2092 msedge.exe 85 PID 2092 wrote to memory of 4224 2092 msedge.exe 85 PID 2092 wrote to memory of 4224 2092 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0f87bb117f4ea22f7b0d71095379e8e4_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd860746f8,0x7ffd86074708,0x7ffd860747182⤵PID:1280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,7121399291677643784,15759848390342107105,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:3412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,7121399291677643784,15759848390342107105,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,7121399291677643784,15759848390342107105,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:82⤵PID:4224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7121399291677643784,15759848390342107105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:4708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7121399291677643784,15759848390342107105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,7121399291677643784,15759848390342107105,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4952 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:868
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1220
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59e3fc58a8fb86c93d19e1500b873ef6f
SHA1c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA256828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
SHA512e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
-
Filesize
152B
MD527304926d60324abe74d7a4b571c35ea
SHA178b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA2567039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
SHA512f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
-
Filesize
5KB
MD566834c83de1214acee110e322d4b1b55
SHA159d9978c3e8999be01bd297aa901decd9c2026f3
SHA2563b15b7068b901156315056a3edc7ea848fe4a9e37fa1e1a7ddf0cf2978ef256b
SHA512945cca3aec3682ba9087fe70ad8d69beba2efedd39a4e2a7d6c0be41f778fe6e8ce66fc1a57328285bde442d17d82e3071b5d84ade1e20dfb039f61a80578db9
-
Filesize
6KB
MD5cff287991fd345475f26d1e8605f93b9
SHA1aefc3a25b3bc742256b394ae39c52ade1d901d76
SHA2562d3b772452642d5b665a05704e9fbb62ca337fe3d672ba00c4f50c6b97fa987e
SHA5127671c03e9387ee96f39f53ae798a5064bbd8a8c11ec84669bdc6a4d2df991d3a4bfcbfccca7964892c07fa5d08fa48107415131b8fcd283bf444dde08c877840
-
Filesize
6KB
MD59a0e1e853a3c6876fdcae69dc6ee057c
SHA1eae0877b12484823fe35a2966c7e891144aebdcc
SHA256b5736e208837bd737e4e6226949e1841bdd629c01865df7b5c0eb3efd8d93dd2
SHA5122b3a57f53839ba9119cb6019074af94d3ad4ce75e436a96610bb4bad200973d94dcbb096d3a9ff9c5c559edf79d82ef9e91d296a647ef075f1d6235784290316
-
Filesize
10KB
MD573a404ae9808f79bdd7372b67a567667
SHA194fba023b989709c39b3fae56fdf99932a593965
SHA2561a6eae40743a6977097fb0203b955e95f604ab49961c29449fdd0ff24d636e76
SHA5129d0e4768574146fb6ad92c1eab283ff14ddf9f2f81bce96acf4f437604db050d1fe2702da4ad853a3079d0826d3d8472fafa9604086c5ad7ee1d86874ef2a4dd