Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
05/05/2024, 22:16
Static task
static1
Behavioral task
behavioral1
Sample
196f7c22300f4d5c566ea16eed35d08b_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
196f7c22300f4d5c566ea16eed35d08b_JaffaCakes118.html
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 196f7c22300f4d5c566ea16eed35d08b_JaffaCakes118.html
- Size 58KB
- Sample240505-16rgjsfd8y
- SHA256 3df29dab2c628b7bebed0f7b2d5dd2f3a52d43a6595d005db3dba34e3f4076e9
- MD5 196f7c22300f4d5c566ea16eed35d08b
- SHA1 1042eae16080a00d203da7222204f723233ce791
- SHA512 b1f225d208938c9c8b7495d9213ccb8d4432ed2349d526cfa3b884acbfb72fd7b5954b56286536036bdfe1d532c2c6caf4de6205bab81c3be06c470a0937ac96
- SSDEEP 1536:JkLlSgT++HY+lttxx99nn5/rUHyK3E9YzGxSphl6qNN7Ja+G:ilSggJE9YzGxSphl6qNN7M
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 704 msedge.exe 704 msedge.exe 4032 msedge.exe 4032 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4032 wrote to memory of 1016 4032 msedge.exe 84 PID 4032 wrote to memory of 1016 4032 msedge.exe 84 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 384 4032 msedge.exe 85 PID 4032 wrote to memory of 704 4032 msedge.exe 86 PID 4032 wrote to memory of 704 4032 msedge.exe 86 PID 4032 wrote to memory of 2140 4032 msedge.exe 87 PID 4032 wrote to memory of 2140 4032 msedge.exe 87 PID 4032 wrote to memory of 2140 4032 msedge.exe 87 PID 4032 wrote to memory of 2140 4032 msedge.exe 87 PID 4032 wrote to memory of 2140 4032 msedge.exe 87 PID 4032 wrote to memory of 2140 4032 msedge.exe 87 PID 4032 wrote to memory of 2140 4032 msedge.exe 87 PID 4032 wrote to memory of 2140 4032 msedge.exe 87 PID 4032 wrote to memory of 2140 4032 msedge.exe 87 PID 4032 wrote to memory of 2140 4032 msedge.exe 87 PID 4032 wrote to memory of 2140 4032 msedge.exe 87 PID 4032 wrote to memory of 2140 4032 msedge.exe 87 PID 4032 wrote to memory of 2140 4032 msedge.exe 87 PID 4032 wrote to memory of 2140 4032 msedge.exe 87 PID 4032 wrote to memory of 2140 4032 msedge.exe 87 PID 4032 wrote to memory of 2140 4032 msedge.exe 87 PID 4032 wrote to memory of 2140 4032 msedge.exe 87 PID 4032 wrote to memory of 2140 4032 msedge.exe 87 PID 4032 wrote to memory of 2140 4032 msedge.exe 87 PID 4032 wrote to memory of 2140 4032 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\196f7c22300f4d5c566ea16eed35d08b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ff8130f46f8,0x7ff8130f4708,0x7ff8130f47182⤵PID:1016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,10659888866945718938,2162317123666000247,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:22⤵PID:384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,10659888866945718938,2162317123666000247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,10659888866945718938,2162317123666000247,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:82⤵PID:2140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,10659888866945718938,2162317123666000247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:3236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,10659888866945718938,2162317123666000247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:1988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,10659888866945718938,2162317123666000247,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,10659888866945718938,2162317123666000247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1580 /prefetch:12⤵PID:3952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,10659888866945718938,2162317123666000247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:12⤵PID:4500
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2284
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
- MD5 2a70f1bd4da893a67660d6432970788d
- SHA1 ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
- SHA512 26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
- MD5 fbe1ce4d182aaffb80de94263be1dd35
- SHA1 bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
- SHA512 3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 182B
- SHA256 31e2bcfc96bc2a345cc324a71a6eafbe2bc0386c1b11316737e67271b605f847
- MD5 e8d89bf23b32e41f2b4ce7029484d94c
- SHA1 0ea4948e92563fa501faad79999c394950e239fd
- SHA512 9f7dd967bf18f19701dd2c967c7010c9e815fc6aa19c636b04758ad7ce06aef925a969429c2bdcf0e8ff4edd328c2bb93e0f5adb215cc9088ecadebfb1d91d7a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 64fec0fd39ab0e5f640c019764113c07540a6621cecf8d0774d8846d4ebac7f6
- MD5 76dc402b5b867c72362e330b6f32b21e
- SHA1 d0993401267642ca23145e2fbe4203f6ca8cdcf5
- SHA512 cdcac87d6e114eff700043212ef4bab22c3bcb98755de30e00081f93c3d362b4006e2c4e258ae32d30d1064325a6a6543581042397796e774d39dc4a9d255c5a
- SSDEEP 96:nEkNV1BuniK1wpvWMoiVmdeHdt7+UWQyV+VDCziEwb:nEk73BkGWMXbSro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 366fdb30120d195f9c1e80a88118657328ea4ef39bf950a9ca95b52642b64052
- MD5 440f91912a961a7485cb322de385a41e
- SHA1 63a02a63fd88a1dc7fc3cf7ccefd15841b78dfb6
- SHA512 15d94703a53953531405f4bb49856ddddf0ff72c6a2a55166b184ad9cce3b8a15baa6a2abf24525e3c1c4aa94129e94678322ba388b9da95439a6b981dd7e426
- SSDEEP 96:nEkIV1BCKniK1wpvWMoiVmdeCMDXjpVepqdty+UWQyV+VDCAiEwb:nEkQ3ClkGWMyMDXjp4pqbtrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 ab9296340c92e76e3a04608e16b55ef42d44da9a46c0314c8f1baae1d9233843
- MD5 6a9389133df09323dedd71d51c8fad14
- SHA1 6ca1ffd55f446d9f46aca7b9c32722d4be16a9eb
- SHA512 cc6dfa5053c980669c54400e1ac470ce7b91ba19504af9058f7ab80bdb1b4e228df6a7105619dbf80924927e86278327725c7810c6e8ea537d6b5c14f6786060
- SSDEEP 96:nEkIV1BuniK1wpvWMoiVmdeHdt7+UWQyV+VDCAiEwb:nEkQ3BkGWMXbSrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 56fb1247e7540a93f72ec3507c2e398cacf32c44aff78ae6daf4fff113c44288
- MD5 93a099108b67d9c9491c8ef5e1455a94
- SHA1 1b3cb791908e2bf021159f153a6ae0705c64c8da
- SHA512 ec131f5d13acd0d5f22f3ef61d4dab4a5499ac56063937b5fb214a914047690e3f164413a881883aebf9419cc0865c9798f462b06011b8a50c2dbf72f9f0c406
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupsBcpe2RU2OiI+OblfBhDa8:A9iIxuERzA83h09RZxYLhI/XDafEBqa
- MD5 SHA1 SHA512 SSDEEP