Analysis
- max time kernel
145s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
02/05/2024, 10:08
Static task
static1
Behavioral task
behavioral1
Sample
0e340d279b287ae3909ff70b5523b67a_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
0e340d279b287ae3909ff70b5523b67a_JaffaCakes118.html
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 0e340d279b287ae3909ff70b5523b67a_JaffaCakes118.html
- Size 146KB
- Sample240502-l6qspaee91
- SHA256 0938922426c526d147dabc080c5b65b54e4f00c24d27158086760e527192119a
- MD5 0e340d279b287ae3909ff70b5523b67a
- SHA1 d425341cdbec426230b4471a17bb67ba7181ce33
- SHA512 9adab984d9591bcd4d9c18c172b8802f17c866eb61d70b9edfca9e387d16c9446bc9be599b5dd25b6b7b7bb213fad23683b9b0c144029ead94d03383076fe830
- SSDEEP 3072:VHT2s5/SaTiVEbsdp+aCaat+4HxwVu/Eg0hxjdr4Swmf1E0D+dah+IL1pDt8GSo9:VHTzeOCR
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3764 msedge.exe 3764 msedge.exe 3024 msedge.exe 3024 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe 3024 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3024 wrote to memory of 3076 3024 msedge.exe 84 PID 3024 wrote to memory of 3076 3024 msedge.exe 84 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 752 3024 msedge.exe 86 PID 3024 wrote to memory of 3764 3024 msedge.exe 87 PID 3024 wrote to memory of 3764 3024 msedge.exe 87 PID 3024 wrote to memory of 908 3024 msedge.exe 88 PID 3024 wrote to memory of 908 3024 msedge.exe 88 PID 3024 wrote to memory of 908 3024 msedge.exe 88 PID 3024 wrote to memory of 908 3024 msedge.exe 88 PID 3024 wrote to memory of 908 3024 msedge.exe 88 PID 3024 wrote to memory of 908 3024 msedge.exe 88 PID 3024 wrote to memory of 908 3024 msedge.exe 88 PID 3024 wrote to memory of 908 3024 msedge.exe 88 PID 3024 wrote to memory of 908 3024 msedge.exe 88 PID 3024 wrote to memory of 908 3024 msedge.exe 88 PID 3024 wrote to memory of 908 3024 msedge.exe 88 PID 3024 wrote to memory of 908 3024 msedge.exe 88 PID 3024 wrote to memory of 908 3024 msedge.exe 88 PID 3024 wrote to memory of 908 3024 msedge.exe 88 PID 3024 wrote to memory of 908 3024 msedge.exe 88 PID 3024 wrote to memory of 908 3024 msedge.exe 88 PID 3024 wrote to memory of 908 3024 msedge.exe 88 PID 3024 wrote to memory of 908 3024 msedge.exe 88 PID 3024 wrote to memory of 908 3024 msedge.exe 88 PID 3024 wrote to memory of 908 3024 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0e340d279b287ae3909ff70b5523b67a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffda12646f8,0x7ffda1264708,0x7ffda12647182⤵PID:3076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,256753164805628889,1235342166034513647,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:22⤵PID:752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,256753164805628889,1235342166034513647,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,256753164805628889,1235342166034513647,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:82⤵PID:908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,256753164805628889,1235342166034513647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:12⤵PID:3896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,256753164805628889,1235342166034513647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:2912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,256753164805628889,1235342166034513647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:12⤵PID:2828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,256753164805628889,1235342166034513647,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3996
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4488
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7dd7bd79-c7ab-4a3a-b96b-7878f8a8244a.tmp
- Size 11KB
- SHA256 3c048519e390953205e89699dbedcfca034478fd341c54db0a23957923a0fc82
- MD5 427599e951cbd70aded5ba990c9a7746
- SHA1 747f0e046c8c40e8277f1afc803512c6170dcd19
- SHA512 06189823bead4d7191c8549b814b2b4868257dd6b70e58376439149f3ea34bf8f989de666d8e99c5463c79b9739d2047a0c1c9ead6f81d4d7651354e039107f1
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupd8qe2RUW/OEVCX+OblfBhq:A9iIxuERzA83h09RZxYn3cX/XDafEB+5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b
- MD5 62c02dda2bf22d702a9b3a1c547c5f6a
- SHA1 8f42966df96bd2e8c1f6b31b37c9a19beb6394d6
- SHA512 a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a
- MD5 850f27f857369bf7fe83c613d2ec35cb
- SHA1 7677a061c6fd2a030b44841bfb32da0abc1dbefb
- SHA512 7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
- Size 20KB
- SHA256 9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
- MD5 b6c8122025aff891940d1d5e1ab95fce
- SHA1 a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
- SHA512 e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10
- SSDEEP 384:kBod/X+YnvYU+f2y2ScAWYl/7UOSVP6/EvI9mzX42MoOxEuF:kBF+i/PvVIOSVi8vSmzXjXY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
- Size 44KB
- SHA256 1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8
- MD5 88477d32f888c2b8a3f3d98deb460b3d
- SHA1 1fae9ac6c1082fc0426aebe4e683eea9b4ba898c
- SHA512 e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3
- SSDEEP 768:zznaC0S3xL3KmGLYSKhxDefA2ihGqfz9fNfh0QqdgDnqQpvSjCQNs9f9wAcCGI:PnajS3x3K1JKPCwhLfZdh0Qq6dQNef9x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 144B
- SHA256 ff2792df9b48df57355f997d5a9d6e602c85f52b3c5c4c559d926cae0e60445a
- MD5 088ff94667a2db4b860934e1160a7b63
- SHA1 8814f8fda82cf98c9858c904cd4b064fd1af680d
- SHA512 8bec6cc59c63e9c84c4f3442dfe5c7f20b5968a29ae7aad868785d900a027ffe0260b9bdcb2c637f65d3118d16a9bc976a2476592f22b2c0749a571db324ebc9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 1KB
- SHA256 15cf36ba4a28592ab8d2c4290be29ad908e0965e1dc4a3074d2ca53e4b39ba89
- MD5 257180ce0e56b4dea8e660fe73d50ee9
- SHA1 faf2de4229e34f48079e4914c7c2fd3157153d1a
- SHA512 9e12906ea7a0dc62db8743ea27756f3b635189439a25d02f96f098dc65efd52b0b5f86447e041ef3fd5ceeb5c9ea0546f542ba53674e222783df579e80540dec
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 3e37bd3716ade51afcbe7ccc46f1a37e3df9f4d6c4c5c5f90e3c971132b22243
- MD5 f61e1990c47ebadc312e08c1b76d7612
- SHA1 5d6e2f84e569b53d860e3cc7537bcbdcacb79239
- SHA512 41389ca02af136f109c958dbf469078d1f342f7c5be543c9c65144f601191b7b3ac3b385b2e4816b2fb18ddb0ffd98e37f3a3ae56bdfb74b81ab45cca095771b
- SSDEEP 96:nCkbh1u+fTwpvWMoiVmdeHqVXUWQyV+VDCziEwb:nCkto+fTGWMXcro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 09281980eb0aae5f4e796e5ff5fd90ffcb191eed4897fc51f682715a2d7a459d
- MD5 d93c838875f6002a264194210a839307
- SHA1 09c624f037fb275eb131cc2c14187b50066fceb8
- SHA512 74a612ee0533fa53b40696ea79da7d43fa85f54080673a7ee5a5b71801e2d435506f4de9f60eb25fbffa37a5eae585b5c8d322a3dba44b812fd2451e95472433
- SSDEEP 96:nCkSh1u+fTwpvWMoiVmdeJVsBNLWn5A2qVXUWQyV+VDCAiEwb:nCkuo+fTGWMZVsBNy5A2crV
- MD5 SHA1 SHA512 SSDEEP