Analysis
-
max time kernel
139s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 07:28
Static task
static1
Behavioral task
behavioral1
Sample
16bb7a7b2328c36ccaa6923a85796280_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
16bb7a7b2328c36ccaa6923a85796280_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
16bb7a7b2328c36ccaa6923a85796280_JaffaCakes118.html
-
Size
156KB
-
MD5
16bb7a7b2328c36ccaa6923a85796280
-
SHA1
5cfb63a555b8460f1362641876df4594a1dbcddb
-
SHA256
b4ef4b2032b203fdaf1ea2ba400d55f2e49846432abe3412fbc134292a0459bc
-
SHA512
6b716026f9d11392610c6a8444a435228a27779dca6fc8c3cd0c1da4be523acbf2a21c928dd0196fc9ac75df66f8fd41c4f74fdb44867d84b96722d499b1293f
-
SSDEEP
1536:iBRT0/8Zj9/L1b66yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:iXzpL166yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4196 msedge.exe 4196 msedge.exe 3936 msedge.exe 3936 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 5096 identity_helper.exe 5096 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3936 wrote to memory of 2332 3936 msedge.exe 82 PID 3936 wrote to memory of 2332 3936 msedge.exe 82 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4920 3936 msedge.exe 83 PID 3936 wrote to memory of 4196 3936 msedge.exe 84 PID 3936 wrote to memory of 4196 3936 msedge.exe 84 PID 3936 wrote to memory of 3480 3936 msedge.exe 85 PID 3936 wrote to memory of 3480 3936 msedge.exe 85 PID 3936 wrote to memory of 3480 3936 msedge.exe 85 PID 3936 wrote to memory of 3480 3936 msedge.exe 85 PID 3936 wrote to memory of 3480 3936 msedge.exe 85 PID 3936 wrote to memory of 3480 3936 msedge.exe 85 PID 3936 wrote to memory of 3480 3936 msedge.exe 85 PID 3936 wrote to memory of 3480 3936 msedge.exe 85 PID 3936 wrote to memory of 3480 3936 msedge.exe 85 PID 3936 wrote to memory of 3480 3936 msedge.exe 85 PID 3936 wrote to memory of 3480 3936 msedge.exe 85 PID 3936 wrote to memory of 3480 3936 msedge.exe 85 PID 3936 wrote to memory of 3480 3936 msedge.exe 85 PID 3936 wrote to memory of 3480 3936 msedge.exe 85 PID 3936 wrote to memory of 3480 3936 msedge.exe 85 PID 3936 wrote to memory of 3480 3936 msedge.exe 85 PID 3936 wrote to memory of 3480 3936 msedge.exe 85 PID 3936 wrote to memory of 3480 3936 msedge.exe 85 PID 3936 wrote to memory of 3480 3936 msedge.exe 85 PID 3936 wrote to memory of 3480 3936 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\16bb7a7b2328c36ccaa6923a85796280_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbfd4046f8,0x7ffbfd404708,0x7ffbfd4047182⤵PID:2332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,1193513526962561486,9183269338724491505,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2320 /prefetch:22⤵PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,1193513526962561486,9183269338724491505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,1193513526962561486,9183269338724491505,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2440 /prefetch:82⤵PID:3480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,1193513526962561486,9183269338724491505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:2096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,1193513526962561486,9183269338724491505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:1728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,1193513526962561486,9183269338724491505,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1856 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,1193513526962561486,9183269338724491505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 /prefetch:82⤵PID:460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,1193513526962561486,9183269338724491505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,1193513526962561486,9183269338724491505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:12⤵PID:3084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,1193513526962561486,9183269338724491505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:12⤵PID:3248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,1193513526962561486,9183269338724491505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:12⤵PID:1200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,1193513526962561486,9183269338724491505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:12⤵PID:4780
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:724
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eeaa8087eba2f63f31e599f6a7b46ef4
SHA1f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA25650fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
SHA512eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
-
Filesize
152B
MD5b9569e123772ae290f9bac07e0d31748
SHA15806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA25620ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
SHA512cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
-
Filesize
5KB
MD509f9c363108ef057cdea2c01d7e92d55
SHA1feae2ee6a160544e998a24ce8e5e7e89e2068f3f
SHA256b8e086f34bf96795ba1caf532562c474752d031163c0339efbe0536c6d4f8ab6
SHA5124ba9297b4bf3c0a1632a047cc42d40ee2216d91fcfba7aace70f22620fad880d91054d8ee26e80dbdc88febece6bd9411afaf4ce2b79369859874cc567696be7
-
Filesize
6KB
MD5cf3e713d897f1e21e4ef7169a19d9c98
SHA19e7c2a7ce1a74222061260eb81a93e075d9cb3ec
SHA2561804db54c3aca094949a39315527fab3eca15cc444bae976d0ce000d7a6e61c5
SHA512d57b8c91fa84be3e8b3808f9261b6332e60e843b1c70db68622857fa2fe1c490aab7bcad9ba8bb3d9d896ba5b67eabf4b8652f996dffd1d318409d6080c5da8b
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5d3ee808fe8755833a335e52c3093937f
SHA1ff365ad535f3ada3ab17357d93ff47c816f10246
SHA2564e0a8812f17cbaac619da3eba3cb0f240704e28064b5cf6a119c68af25775e2a
SHA5125d04a7b82c86a30b254600f0cfa602e16167ae52c409cdeadd8c3a60edb5028c184e4251d9fcbd45f7d1bdaafb627355b78be93ababbe0bb5455ccb369da75fa