Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
04/05/2024, 14:20
Static task
static1
Behavioral task
behavioral1
Sample
131a3395725ff1d30a8bc1fce68846a5_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
131a3395725ff1d30a8bc1fce68846a5_JaffaCakes118.html
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 131a3395725ff1d30a8bc1fce68846a5_JaffaCakes118.html
- Size 184KB
- Sample240504-rnewcsbc32
- SHA256 37a486affeeb1c57939d26815323cdf8d0f915c6447e237a491bb7d125aee11b
- MD5 131a3395725ff1d30a8bc1fce68846a5
- SHA1 fbfdf55c29403391e761729d06a015927b4ebcf0
- SHA512 9bdf826596aabebead5d9524c6e3bb9fa52eed516ec0b257bf53ba6640e5b1d3b07bfce77a962a59806676389b620ff16dce5230697a3e7980bae439ca0ca1c0
- SSDEEP 3072:BG5EgyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFis:DsMYod+X3oI+Yn86/U9jFis
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3804 msedge.exe 3804 msedge.exe 712 msedge.exe 712 msedge.exe 468 msedge.exe 468 msedge.exe 468 msedge.exe 468 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 712 msedge.exe 712 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe 712 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 712 wrote to memory of 4664 712 msedge.exe 84 PID 712 wrote to memory of 4664 712 msedge.exe 84 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3456 712 msedge.exe 85 PID 712 wrote to memory of 3804 712 msedge.exe 86 PID 712 wrote to memory of 3804 712 msedge.exe 86 PID 712 wrote to memory of 4136 712 msedge.exe 87 PID 712 wrote to memory of 4136 712 msedge.exe 87 PID 712 wrote to memory of 4136 712 msedge.exe 87 PID 712 wrote to memory of 4136 712 msedge.exe 87 PID 712 wrote to memory of 4136 712 msedge.exe 87 PID 712 wrote to memory of 4136 712 msedge.exe 87 PID 712 wrote to memory of 4136 712 msedge.exe 87 PID 712 wrote to memory of 4136 712 msedge.exe 87 PID 712 wrote to memory of 4136 712 msedge.exe 87 PID 712 wrote to memory of 4136 712 msedge.exe 87 PID 712 wrote to memory of 4136 712 msedge.exe 87 PID 712 wrote to memory of 4136 712 msedge.exe 87 PID 712 wrote to memory of 4136 712 msedge.exe 87 PID 712 wrote to memory of 4136 712 msedge.exe 87 PID 712 wrote to memory of 4136 712 msedge.exe 87 PID 712 wrote to memory of 4136 712 msedge.exe 87 PID 712 wrote to memory of 4136 712 msedge.exe 87 PID 712 wrote to memory of 4136 712 msedge.exe 87 PID 712 wrote to memory of 4136 712 msedge.exe 87 PID 712 wrote to memory of 4136 712 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\131a3395725ff1d30a8bc1fce68846a5_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedf1f46f8,0x7ffedf1f4708,0x7ffedf1f47182⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,16466008630243778070,9031495150028332208,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:22⤵PID:3456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,16466008630243778070,9031495150028332208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,16466008630243778070,9031495150028332208,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:82⤵PID:4136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16466008630243778070,9031495150028332208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:3708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16466008630243778070,9031495150028332208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,16466008630243778070,9031495150028332208,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:468
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1424
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
- MD5 2a70f1bd4da893a67660d6432970788d
- SHA1 ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
- SHA512 26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
- MD5 fbe1ce4d182aaffb80de94263be1dd35
- SHA1 bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
- SHA512 3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 af5d4ef9e8ee42ada00e235a2aab599271809e8ed3c31fe2c858456596567d9c
- MD5 166f8944751b48c7ffd772a8b697e263
- SHA1 c06acd58f6c05cf804c14d6a117bcc1217bc6e43
- SHA512 8108212db202313036ccbf1efad3392fc88352908d9aaf556517bf303f523c4397d46ce07c9990c6b561c1a7a7eccc1925f1c850097c45a73a38bd4ef48ec119
- SSDEEP 96:nBkb6c16+niK1wpvWMoiVmdeHdt7a+UWQyV+VDCziEwb:nBkGcsxkGWMXb++ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 af5a0189c14d1b203be3faedd52263ded4b8bbb9dd6cb1d93b78be412ae15e13
- MD5 e59fcb65005c3a87197f2e4f0b6a59b7
- SHA1 599e3497bbe3f54aabf7c7a644cb6ef72c0895b7
- SHA512 e382239e6e5f80ff7c2311ef6eb16e3ad93b19e6fc203cc522acf86921def73f5c3c6aa498f0cc87e8ee6609e796520281244df04ab2b971659151c80ff20614
- SSDEEP 96:nBkS6c16PniK1wpvWMoiVmdeHdt7a+UWQyV+VDCAiEwb:nBkXcsKkGWMXb++rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 5b143330de6fb6f12bd88f7b045c66f88a04730bada0dbfd6867732865574505
- MD5 5a82c3ecba7b06c0c67c3b193d0a720e
- SHA1 b39d437231597f195e5a66ef3a6557cb4d2d0fb9
- SHA512 4d351dde30ebde2b0cdff4acfce01f496321a3576100a22a039676d2e6a464854b9f13d286e1e6d2fb2716dbaaa7f587aaf86fb3de3521013a877ebf22c3dc7b
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupNBctde2RUWOir+OblfBhDL:A9iIxuERzA83h09RZxYo55r/XDafEBv1
- MD5 SHA1 SHA512 SSDEEP