Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02-07-2024 09:18
Static task
static1
Behavioral task
behavioral1
Sample
1ec6a4c30a135fe8f2187f532f5cada0_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1ec6a4c30a135fe8f2187f532f5cada0_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
1ec6a4c30a135fe8f2187f532f5cada0_JaffaCakes118.html
-
Size
697KB
-
MD5
1ec6a4c30a135fe8f2187f532f5cada0
-
SHA1
ff21964d7beda6929fdb59b3590297e883968b27
-
SHA256
7a51622ad8bf54be2dee12de89217733c07112c515dd8ba33438661bd32957d9
-
SHA512
a343c16a62f8eac416daeab9752ec57436b46acf19805c37073da0906b06b99e77b3008d93cdef78a8e31bdc62154a6603c15e88f2688baa6d6e8c00ab589620
-
SSDEEP
1536:SgUlmyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGL:SgbyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exemsedge.exepid process 4080 msedge.exe 4080 msedge.exe 3568 msedge.exe 3568 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
msedge.exepid process 3568 msedge.exe 3568 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe 3568 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3568 wrote to memory of 1664 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 1664 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 512 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 4080 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 4080 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe PID 3568 wrote to memory of 3192 3568 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1ec6a4c30a135fe8f2187f532f5cada0_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8c3c46f8,0x7fff8c3c4708,0x7fff8c3c47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,18253453332153038561,2645635218595721073,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,18253453332153038561,2645635218595721073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,18253453332153038561,2645635218595721073,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18253453332153038561,2645635218595721073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18253453332153038561,2645635218595721073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,18253453332153038561,2645635218595721073,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4896 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5055e5157807fec604ccd25ce9ecbe8e1
SHA1dc444e799ab7ad72335bcb7c3b659e629bcb242c
SHA2565b0a32f6239c6104b248dca9d8ee6afeea5ed1503a5f59a76f7422e9f359b7b0
SHA51210798a2ae7d353f4031e69c2f7020a67b8fb4ec8d0e8ea3bb5f831190f7c304f023d004fa50c507bbb49686563e5767d01a20d6ac67f135cc2469a4e1442b759
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5d6d39cb7644fbddedb2765a61bf630d9
SHA10dd27c5af5998a23c645ab3bd48fbd0d6f5ce578
SHA2562005edae741cf191d482682622224a157a6e275ffc3e7f6f8edea0b791e48438
SHA512610de3de65511374f3e9fa2b287d511a179dbfb5be100d03b8ca619c0ed16d079cd42d3bdc6665345651a705b820885c0b172c095ab537eef499158a858bb730
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD57010cd4e8ba4c9c463ecd0929568f2ff
SHA1430f08f222e1f64df2dc6fa639daaa66a825e066
SHA25680f98d68894987ad211e37697729852a52c894607de5e9318c9adf2221286686
SHA5122961bc974198e37305a1bc108083dfeb0ea40705267e358b4bdd51776a89c86dd1cfcd41469e43ca6440e1fe6db8976000b38d31861eccf442d78144de00c340
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD55cbbd9b7d47a995a51a53411b178de59
SHA192281faa42ef3ca84671ce2a554006248300eb78
SHA25610546772443ed8fa5d68786f08e22e62e1f947c9bd81c72336db0c05073e26b5
SHA512c25578456da9d0ea4bbd14230951102aa6f5e36552eae238cad46638dcff3e24e6fcedafa15e256714dafad669fd71149f6c67a550cea59463ef9912706e20ab
-
\??\pipe\LOCAL\crashpad_3568_KBELZGFNMOJVVYLZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e