Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
04/05/2024, 15:27
Static task
static1
Behavioral task
behavioral1
Sample
13543aa2e7775683e1f58709bc0bc70f_JaffaCakes118.html
Resource
win7-20231129-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
13543aa2e7775683e1f58709bc0bc70f_JaffaCakes118.html
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 13543aa2e7775683e1f58709bc0bc70f_JaffaCakes118.html
- Size 158KB
- Sample240504-svs71ahg2w
- SHA256 c944b10f1f82c766f86957f2a8ef616fd3662086864988b09f4aed0ffbad8df5
- MD5 13543aa2e7775683e1f58709bc0bc70f
- SHA1 b186ca11e803ea3a205b8ee29a06804a11caeff2
- SHA512 923964cb168bae05774ee03364904836cfa782c091e0ca8feda75cdb0616fe8c535f57b6ca9b8eb74288e8abc4aa3416afa6fb5ef9387ed730e7680b46d076b0
- SSDEEP 1536:irRTHyQHi5/4qb/kxyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:iFH/qjkxyfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3612 msedge.exe 3612 msedge.exe 4760 msedge.exe 4760 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4760 msedge.exe 4760 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4760 wrote to memory of 1496 4760 msedge.exe 83 PID 4760 wrote to memory of 1496 4760 msedge.exe 83 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 2796 4760 msedge.exe 84 PID 4760 wrote to memory of 3612 4760 msedge.exe 85 PID 4760 wrote to memory of 3612 4760 msedge.exe 85 PID 4760 wrote to memory of 1244 4760 msedge.exe 86 PID 4760 wrote to memory of 1244 4760 msedge.exe 86 PID 4760 wrote to memory of 1244 4760 msedge.exe 86 PID 4760 wrote to memory of 1244 4760 msedge.exe 86 PID 4760 wrote to memory of 1244 4760 msedge.exe 86 PID 4760 wrote to memory of 1244 4760 msedge.exe 86 PID 4760 wrote to memory of 1244 4760 msedge.exe 86 PID 4760 wrote to memory of 1244 4760 msedge.exe 86 PID 4760 wrote to memory of 1244 4760 msedge.exe 86 PID 4760 wrote to memory of 1244 4760 msedge.exe 86 PID 4760 wrote to memory of 1244 4760 msedge.exe 86 PID 4760 wrote to memory of 1244 4760 msedge.exe 86 PID 4760 wrote to memory of 1244 4760 msedge.exe 86 PID 4760 wrote to memory of 1244 4760 msedge.exe 86 PID 4760 wrote to memory of 1244 4760 msedge.exe 86 PID 4760 wrote to memory of 1244 4760 msedge.exe 86 PID 4760 wrote to memory of 1244 4760 msedge.exe 86 PID 4760 wrote to memory of 1244 4760 msedge.exe 86 PID 4760 wrote to memory of 1244 4760 msedge.exe 86 PID 4760 wrote to memory of 1244 4760 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\13543aa2e7775683e1f58709bc0bc70f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3af846f8,0x7ffe3af84708,0x7ffe3af847182⤵PID:1496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,14267739311011606029,7788215377307491279,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:22⤵PID:2796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,14267739311011606029,7788215377307491279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,14267739311011606029,7788215377307491279,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:1244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14267739311011606029,7788215377307491279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:2084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14267739311011606029,7788215377307491279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:2596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,14267739311011606029,7788215377307491279,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3148 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3288
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:680
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562
- MD5 dbac49e66219979194c79f1cf1cb3dd1
- SHA1 4ef87804a04d51ae1fac358f92382548b27f62f2
- SHA512 bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452
- MD5 a9e55f5864d6e2afd2fd84e25a3bc228
- SHA1 a5efcff9e3df6252c7fe8535d505235f82aab276
- SHA512 12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\76662633-f7fb-444f-a22c-daec79230de2.tmp
- Size 6KB
- SHA256 46188c4e03bbf77fe3d80f4cb807524e79b30e62dca39754112e1c12c015ed92
- MD5 856940451c30a99673899b0215b69cbc
- SHA1 4938fb8adac119099f9680e247cbc711a00ed4b2
- SHA512 732fbb789ee353764319ed6f0ebe303a6dbc8f6a924e7684e61599ad5f5933246db62f4fc18808fb173cea816d28e4826e5b08b34419a959fcbf89f5b7b7d16b
- SSDEEP 96:nvAAkSy1jR/hXwpvWMoiVmdeHZqmUWQyV+VDCAiEwb:nvAAkVxRhXGWMXDrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 56e3da55b52aa57b4452ad45fa12631ded6d99c7dcf4e4bffc58701953d84d9f
- MD5 7126bd805f43f0080974a2c1ddf491ed
- SHA1 f59bc2a2822ed445fdd84dcf7cceaabf9837494b
- SHA512 7402e62071db3ed1ee596c88e010d97dac7c9b58f0d008d67aff7ef7d4ee09b072d6d75785d1b39488b3e29ba0700e82b440fc803d80477c1d4600dadfba32cd
- SSDEEP 96:nvAAkby1jK/hXwpvWMoiVmdeHZqmUWQyV+VDCziEwb:nvAAkGxQhXGWMXDro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 22f8e084c28f20992819a72f95f573bc418c5ed5c90605aabac8d32b63794e6b
- MD5 4909eeeb2e423038484fb37313d022cc
- SHA1 7c76689d4e6353cc61438f488d25ad226cdb8eb3
- SHA512 2054787378e98a683d884739eb1ac1ed8496e27fc73d73e26e81c31cf3460f9578a5cd58e71c4dc9443f90671452abe96a5ed1255c534d8c0a289ff2cdc690ab
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupREhYge2RUuwqG++OblfBhO:A9iIxuERzA83h09RZxYKhDk+/XDafEBs
- MD5 SHA1 SHA512 SSDEEP