Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 22:26
Static task
static1
Behavioral task
behavioral1
Sample
152358c2916270dc1c62d69a176d90d1_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
152358c2916270dc1c62d69a176d90d1_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
152358c2916270dc1c62d69a176d90d1_JaffaCakes118.html
-
Size
57KB
-
MD5
152358c2916270dc1c62d69a176d90d1
-
SHA1
0cdf3dbc3e1a4e6f0fee0664be9a0e977ee49fae
-
SHA256
a0f0ea155678965567965e7c193558ac1571c0b28ac7d35e4de632e41984f234
-
SHA512
68e9c1feab0da021f2ec83a8997d7ab414fbcd9537207c8e25b218efa63673308b59028caac8ceff3610f591e2def66b9d9fc75bf2413da95b9d484c2d90f6c4
-
SSDEEP
1536:gQZBCCOdU0IxCBwJPTVS550aV7bIxDO2+pr8cBg82tIUz6gXRtTYfXlvaV98KGw1:gk2e0IxRPTVS550aV7bIxDO2+pr8cBgx
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2452 msedge.exe 2452 msedge.exe 1696 msedge.exe 1696 msedge.exe 3248 identity_helper.exe 3248 identity_helper.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe 1696 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1696 wrote to memory of 4612 1696 msedge.exe 84 PID 1696 wrote to memory of 4612 1696 msedge.exe 84 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 1560 1696 msedge.exe 85 PID 1696 wrote to memory of 2452 1696 msedge.exe 86 PID 1696 wrote to memory of 2452 1696 msedge.exe 86 PID 1696 wrote to memory of 540 1696 msedge.exe 87 PID 1696 wrote to memory of 540 1696 msedge.exe 87 PID 1696 wrote to memory of 540 1696 msedge.exe 87 PID 1696 wrote to memory of 540 1696 msedge.exe 87 PID 1696 wrote to memory of 540 1696 msedge.exe 87 PID 1696 wrote to memory of 540 1696 msedge.exe 87 PID 1696 wrote to memory of 540 1696 msedge.exe 87 PID 1696 wrote to memory of 540 1696 msedge.exe 87 PID 1696 wrote to memory of 540 1696 msedge.exe 87 PID 1696 wrote to memory of 540 1696 msedge.exe 87 PID 1696 wrote to memory of 540 1696 msedge.exe 87 PID 1696 wrote to memory of 540 1696 msedge.exe 87 PID 1696 wrote to memory of 540 1696 msedge.exe 87 PID 1696 wrote to memory of 540 1696 msedge.exe 87 PID 1696 wrote to memory of 540 1696 msedge.exe 87 PID 1696 wrote to memory of 540 1696 msedge.exe 87 PID 1696 wrote to memory of 540 1696 msedge.exe 87 PID 1696 wrote to memory of 540 1696 msedge.exe 87 PID 1696 wrote to memory of 540 1696 msedge.exe 87 PID 1696 wrote to memory of 540 1696 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\152358c2916270dc1c62d69a176d90d1_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3dd746f8,0x7fff3dd74708,0x7fff3dd747182⤵PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4954036136935626064,17767468890165942925,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:1560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,4954036136935626064,17767468890165942925,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,4954036136935626064,17767468890165942925,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:82⤵PID:540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4954036136935626064,17767468890165942925,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:1720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4954036136935626064,17767468890165942925,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4954036136935626064,17767468890165942925,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:12⤵PID:692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4954036136935626064,17767468890165942925,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:12⤵PID:1180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4954036136935626064,17767468890165942925,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:12⤵PID:3092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4954036136935626064,17767468890165942925,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:82⤵PID:3164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4954036136935626064,17767468890165942925,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4954036136935626064,17767468890165942925,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:12⤵PID:2912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4954036136935626064,17767468890165942925,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:12⤵PID:1004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4954036136935626064,17767468890165942925,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2452 /prefetch:12⤵PID:3084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4954036136935626064,17767468890165942925,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:12⤵PID:2440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4954036136935626064,17767468890165942925,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1072
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1648
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eeaa8087eba2f63f31e599f6a7b46ef4
SHA1f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA25650fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
SHA512eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
-
Filesize
152B
MD5b9569e123772ae290f9bac07e0d31748
SHA15806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA25620ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
SHA512cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
-
Filesize
213KB
MD5f942900ff0a10f251d338c612c456948
SHA14a283d3c8f3dc491e43c430d97c3489ee7a3d320
SHA25638b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6
SHA5129b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize504B
MD50296eaa3331b16608a56f3a35911557f
SHA1cf19145ea9307ff83d45baf9c148a76a126b1371
SHA25646db68065a19157d187f037b9d62f383b95c3c4ca6e39243618c7c9ca5e73dd3
SHA512d1b088a039a93cf2f81534eec3842ba047230ac3a5bde2172374fc6ed055888ca383825d99422325ac5887122fdaef4eaf6f75652210cdb52fe38cf82ed8d243
-
Filesize
1KB
MD5ae9710d57c46fa2e634475214b040df3
SHA15e2ddfb6245e0e48dadd3d718424603149016fc3
SHA25661dc82f08adb5845e1d575f250564110321cbe629623b81dd85774165738a11e
SHA512ba2ed7cdb62ecb6819d19882b01f5dbd248be633da70a9078ed4b75f6d9bcd08dc7af0736a78a62d5d7e1747716792103302e4ab8e5c8b195817ab496ef5f2c9
-
Filesize
6KB
MD547a57155f4e1a1c20f671ed58efccf8b
SHA1c6e57597bbd89c761c03b5a0d28c1cccdb3711ff
SHA256e0abf42e68527ff1f2fd1a8ca253fe46d9f345b12d4c1584d508526d7d93899b
SHA512c456042b85b902012a427e156bde6ca8a86ae5e56ac108a537882d4ceeda909fd3b990e56d8f7a8977fa4ec5f89755b471bf9a0c50e4181d718016a4f6d42df6
-
Filesize
6KB
MD5fb0d178512fdf4af8685e88ad1ec548b
SHA166feab298ab175a9401af1a16c8175d94db68c4b
SHA2565e686000029e2f460edebe5acda335a762f67126469d285d678adfda6665fc1a
SHA512f48a1c0da164f06735bccbabb043fe81a241b7018e23682c8b415f18f7bd9541965120895474b3fe00a34bd07f9a31e0f97e60f0447974e7717caa63bddd4248
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5328570306e879149ec83158023fb686e
SHA1c0bdcdf67de477282e53e03e4cdb1f1fb84508ba
SHA256d1855d55232b81d4365ee9bfb89c76e901c24c309aa447bc3995c5404554e65a
SHA51272068704f1b905483d8e7d839efb67d8b6e9f7a125f759def832917218198f3214a423ef73594c288c2bef66914e360d4eb53c92c7bcd002b84dd2dcfb673153