Analysis
-
max time kernel
139s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 17:27
Static task
static1
Behavioral task
behavioral1
Sample
0fd95bd8d760195a7e4c7977573e15da_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0fd95bd8d760195a7e4c7977573e15da_JaffaCakes118.html
Resource
win10v2004-20240910-en
General
-
Target
0fd95bd8d760195a7e4c7977573e15da_JaffaCakes118.html
-
Size
154KB
-
MD5
0fd95bd8d760195a7e4c7977573e15da
-
SHA1
00325333f77f7591aeab0eb473f1b49fabdcf330
-
SHA256
08d55d5acf7bac89c43f16547103db85118b33da2f06a1e3433d8732b292154f
-
SHA512
339a6d0ca31f5bc26b7a819cc779d90a2ad16c0c19bbe253aa281829f15f42ed60352d1ffa72a8abd6ed668a06e6db589f5b82fa646fdd7236883b3e3313a4fd
-
SSDEEP
1536:iORT3mC7RcRkuBY5XbryLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXu:iEJb5XbryfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5084 msedge.exe 5084 msedge.exe 2188 msedge.exe 2188 msedge.exe 3904 msedge.exe 3904 msedge.exe 3904 msedge.exe 3904 msedge.exe 1132 identity_helper.exe 1132 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 1632 2188 msedge.exe 85 PID 2188 wrote to memory of 1632 2188 msedge.exe 85 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 4632 2188 msedge.exe 86 PID 2188 wrote to memory of 5084 2188 msedge.exe 87 PID 2188 wrote to memory of 5084 2188 msedge.exe 87 PID 2188 wrote to memory of 3296 2188 msedge.exe 88 PID 2188 wrote to memory of 3296 2188 msedge.exe 88 PID 2188 wrote to memory of 3296 2188 msedge.exe 88 PID 2188 wrote to memory of 3296 2188 msedge.exe 88 PID 2188 wrote to memory of 3296 2188 msedge.exe 88 PID 2188 wrote to memory of 3296 2188 msedge.exe 88 PID 2188 wrote to memory of 3296 2188 msedge.exe 88 PID 2188 wrote to memory of 3296 2188 msedge.exe 88 PID 2188 wrote to memory of 3296 2188 msedge.exe 88 PID 2188 wrote to memory of 3296 2188 msedge.exe 88 PID 2188 wrote to memory of 3296 2188 msedge.exe 88 PID 2188 wrote to memory of 3296 2188 msedge.exe 88 PID 2188 wrote to memory of 3296 2188 msedge.exe 88 PID 2188 wrote to memory of 3296 2188 msedge.exe 88 PID 2188 wrote to memory of 3296 2188 msedge.exe 88 PID 2188 wrote to memory of 3296 2188 msedge.exe 88 PID 2188 wrote to memory of 3296 2188 msedge.exe 88 PID 2188 wrote to memory of 3296 2188 msedge.exe 88 PID 2188 wrote to memory of 3296 2188 msedge.exe 88 PID 2188 wrote to memory of 3296 2188 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0fd95bd8d760195a7e4c7977573e15da_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9b3f46f8,0x7ffe9b3f4708,0x7ffe9b3f47182⤵PID:1632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,1844582942124246774,2321753770560506728,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:22⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,1844582942124246774,2321753770560506728,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,1844582942124246774,2321753770560506728,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:3296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,1844582942124246774,2321753770560506728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,1844582942124246774,2321753770560506728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:4512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,1844582942124246774,2321753770560506728,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,1844582942124246774,2321753770560506728,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:82⤵PID:668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,1844582942124246774,2321753770560506728,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,1844582942124246774,2321753770560506728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:12⤵PID:2076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,1844582942124246774,2321753770560506728,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵PID:3092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,1844582942124246774,2321753770560506728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:12⤵PID:4104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,1844582942124246774,2321753770560506728,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:12⤵PID:1128
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3204
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5db1ed3bbcaa8e96c29a0b57e72bf0319
SHA19bc11860837a2bcdd048613ba8dd76d6d77d32d9
SHA2567c7db5dde536599fd7ffd4dee8e03ca0f6680e662022869057b09a4635b9b87c
SHA512eb7375877e9b51ebcf8cfc62cf822fdce3fdce837fbbd00d4d54c52c4f67bd82408e4809e1c92f32e9f3edc9e6726910f752fbeaf14704745688b0239405e6c8
-
Filesize
152B
MD5b4b5eaf7edd9d5391ddfdb694e0cd888
SHA1d1f92fbd238c4d5fb6861a83153893568d514586
SHA2561d5fc1e6da67b60df30ee83dd11359ec3dbe0c4bdddff2f2f862fa9c4619d903
SHA5121b62d5740572b1c17dadcb83d9e0017d6a8ff94cc64bc024cc47fa92a8180f7c2d18bef79ddf5cac8a9a97ecefd8461b06665e522acb0c5857dac1a2838fc048
-
Filesize
5KB
MD5d92eb0fb49b38cf3f5b266588d3581a7
SHA1d28dd0da7e4a65c52ef8a9a5d41a238f6fa7e4af
SHA25682bcd2a83401f51601b66db8c13c53a24372395fa3f43dabca96e11689cf655e
SHA51236c57995991fc7b814339d643c1c91e3cd9ba181bef9b558df673dba120b9074ce2c8a1820faad3f384796c1c2e6f8eac7dc6846bd62a599598abf33b0558292
-
Filesize
5KB
MD52176d492eb0bbecab83f51bb6c6f67a9
SHA13e58da1c56c2a8d6f262994ef10311c41409c257
SHA25622af9790d5f15daccad0fbcade0ef52f56ba954f8bb5baa6df8d21576d71cf1a
SHA5123ab8e851770788154ab4dd87e0b5c6206cfacdfce2d28036527f76c805cff81ec2b11b88c5c555e55c39d337f407b2da2e42087208e69a99262a820468a6129b
-
Filesize
24KB
MD5941ea4c983b3cf877ce6e1aab38f2794
SHA1c4fcce581d0660a0c96d0579aedb528a8168233c
SHA2563d4479f291d239eec609801437c1962e41e19c53a3eadd2f95342167fa7ad342
SHA512f47836cc619ea50f24d3804a697bb562781e812a65285959d7dbce53db8945cbbab2f9b8290ba2bd9925f620858918ddc676c082cdadae8444a9751d642a381b
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
9KB
MD50fc25aa0c618128ca5611559550bdee3
SHA13e345b7998d93f555ea26f929243a9af5c65ca07
SHA256ec26e793d725b8cf7e75d4f947d4ee8245c4055dfdd8386e4faca283de7552b1
SHA5125d2cd520adaa9abeb4e9aa10f51f04559e00034d0f7750a727acd422263f4cee8a616fa95d15927829fc9397466baae7255f3328e2e2614fa2011c84e6a695ee