Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 08:51
Static task
static1
Behavioral task
behavioral1
Sample
e48a3b3e84ce7d02b778c398ebe7a656_JaffaCakes118.html
Resource
win7-20240215-en
General
-
Target
e48a3b3e84ce7d02b778c398ebe7a656_JaffaCakes118.html
-
Size
73KB
-
MD5
e48a3b3e84ce7d02b778c398ebe7a656
-
SHA1
5a451ece0af14e55e39c5018d1be84231508e0f5
-
SHA256
e580d8e162de6dc7a05915beca21d41c2e121d4a6b7795d9a4ef694f39139424
-
SHA512
b563d94364289feba67973ea05600314658e01fc6b028764fece4b014461d10932655ff149a4968e26dcf135b109943facea326f9bfafe4014c35effb630b61c
-
SSDEEP
1536:3mYXQxG52Y9MD22NbfmategNiXOAcktDYDoTezhU1BJUCY99tdGGo4ONyaP0tqR0:3kxG5ZWRtd9+Aw+V
Malware Config
Signatures
-
Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
Processes:
flow ioc 166 https://jira.ops.aol.com/secure/attachment/688199/failwhale.html -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 400 msedge.exe 400 msedge.exe 412 msedge.exe 412 msedge.exe 4868 identity_helper.exe 4868 identity_helper.exe 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 412 wrote to memory of 1448 412 msedge.exe msedge.exe PID 412 wrote to memory of 1448 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 2092 412 msedge.exe msedge.exe PID 412 wrote to memory of 400 412 msedge.exe msedge.exe PID 412 wrote to memory of 400 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe PID 412 wrote to memory of 5016 412 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e48a3b3e84ce7d02b778c398ebe7a656_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff515946f8,0x7fff51594708,0x7fff515947182⤵PID:1448
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,6924247190047541353,16199869441454139413,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:22⤵PID:2092
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,6924247190047541353,16199869441454139413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:400 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,6924247190047541353,16199869441454139413,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:82⤵PID:5016
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6924247190047541353,16199869441454139413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:1512
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6924247190047541353,16199869441454139413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:1280
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6924247190047541353,16199869441454139413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:12⤵PID:2288
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,6924247190047541353,16199869441454139413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:82⤵PID:3584
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,6924247190047541353,16199869441454139413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4868 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6924247190047541353,16199869441454139413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:12⤵PID:3572
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6924247190047541353,16199869441454139413,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:12⤵PID:2460
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6924247190047541353,16199869441454139413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:12⤵PID:1732
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6924247190047541353,16199869441454139413,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:12⤵PID:2612
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,6924247190047541353,16199869441454139413,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4748 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3380
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3740
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f35bb0615bb9816f562b83304e456294
SHA11049e2bd3e1bbb4cea572467d7c4a96648659cb4
SHA25605e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71
SHA512db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD51eb86108cb8f5a956fdf48efbd5d06fe
SHA17b2b299f753798e4891df2d9cbf30f94b39ef924
SHA2561b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40
SHA512e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2fd575dc-09f7-4f47-a390-0fdf7334fcfa.tmpFilesize
985B
MD5f37eb5d6185e9817a2ddfabde94714ac
SHA1948271f40124eba1bd92dd9ee05555b13a68ae4c
SHA256a2c06a9a0bfaf54c1ca6638c12dd23f59a9acd136b26989a709e7b73e7debcf1
SHA512f3b3b26218826673f05c54a2a08fc0ee4b92c7608b28827ff18ed06f10bb88f2ca853b8d5efc2023d7b4e1eb482f10a7691ff08750475da67d2ae8216ef3a186
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD59841e007c03982baac3ab952e221a314
SHA11bb67037a4b219c4145bf51d7d5a1df7a0564f0e
SHA25622b37afe9e2406b7f41de6eb694436e0cb04757848ef114687758930d100a682
SHA5129eb8c0ef3aa158b61b1fd1e0a3f99d00d68d965a1acbcefd964e686bd632a8335b85fba1aabf56d510c5dfec57d91fdf175656731407ca425d2991f5eb6b3e88
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD54cfa1409ebe8a3d1a6aef7994e5f7ef4
SHA1c07ddfd28d6f92a31719e3ffac02fe530fb6025a
SHA256efa7fe8fd814339f4c7cd59ecbdd5b1f5ccd8c34112357290eb759f953c4b71e
SHA512e9d3293e87b4def55bfc2438441b99643ed9912b8e0d74a1b5e2a1d2068d705ff744800af1c5bf96c1b0687cca4108305ad2f9c5daf03f6cc87998eba2122617
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5ac389f97b16fe2c2c950b733f1255d3a
SHA1fde4a03a9f13029f6e0f436034a023f2efa04c68
SHA256d833d63e1afcfcb87a3d4fcf85fcf21c130c461999a58f19c58d95d90e7ccbed
SHA51267a4ec09b733483de6be9194959945903d1d9e2357e17409d02b6bb0a0c367faf03251291650bd090267d0c8739fbce66f97ff1f631f4ac58f7b11f183f482f2
-
\??\pipe\LOCAL\crashpad_412_OEZOSJNWUWSKPRSCMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e