Analysis
- max time kernel
146s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
05/05/2024, 00:21
Static task
static1
Behavioral task
behavioral1
Sample
1522f0228600b8c1244bc1bafbd60b81_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
1522f0228600b8c1244bc1bafbd60b81_JaffaCakes118.html
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 1522f0228600b8c1244bc1bafbd60b81_JaffaCakes118.html
- Size 190KB
- Sample240505-ank9psbe73
- SHA256 170898ff703e2886be41c5a4097a1306db86384da099fd4137c4973978947723
- MD5 1522f0228600b8c1244bc1bafbd60b81
- SHA1 0d81dc6691c893e4ea146ed2c450e8ed9bf61602
- SHA512 c9750cb83caf4f9102e0f598c5ddf02116f7579ed00ea4aea18d9538d85a347c994f4fddc050964531d45dab807b36bac8780d87a243c2cceba3d5ddcbda4bac
- SSDEEP 3072:UxDNvG8rm/GXmNJUNBVTRQUe+EBw1nLIg6WyHb/th2wHngwD8hRfd:iVXmNJ9md
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2360 msedge.exe 2360 msedge.exe 1664 msedge.exe 1664 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1664 wrote to memory of 2084 1664 msedge.exe 85 PID 1664 wrote to memory of 2084 1664 msedge.exe 85 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 3252 1664 msedge.exe 86 PID 1664 wrote to memory of 2360 1664 msedge.exe 87 PID 1664 wrote to memory of 2360 1664 msedge.exe 87 PID 1664 wrote to memory of 2056 1664 msedge.exe 88 PID 1664 wrote to memory of 2056 1664 msedge.exe 88 PID 1664 wrote to memory of 2056 1664 msedge.exe 88 PID 1664 wrote to memory of 2056 1664 msedge.exe 88 PID 1664 wrote to memory of 2056 1664 msedge.exe 88 PID 1664 wrote to memory of 2056 1664 msedge.exe 88 PID 1664 wrote to memory of 2056 1664 msedge.exe 88 PID 1664 wrote to memory of 2056 1664 msedge.exe 88 PID 1664 wrote to memory of 2056 1664 msedge.exe 88 PID 1664 wrote to memory of 2056 1664 msedge.exe 88 PID 1664 wrote to memory of 2056 1664 msedge.exe 88 PID 1664 wrote to memory of 2056 1664 msedge.exe 88 PID 1664 wrote to memory of 2056 1664 msedge.exe 88 PID 1664 wrote to memory of 2056 1664 msedge.exe 88 PID 1664 wrote to memory of 2056 1664 msedge.exe 88 PID 1664 wrote to memory of 2056 1664 msedge.exe 88 PID 1664 wrote to memory of 2056 1664 msedge.exe 88 PID 1664 wrote to memory of 2056 1664 msedge.exe 88 PID 1664 wrote to memory of 2056 1664 msedge.exe 88 PID 1664 wrote to memory of 2056 1664 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1522f0228600b8c1244bc1bafbd60b81_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa5fd46f8,0x7ffaa5fd4708,0x7ffaa5fd47182⤵PID:2084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15246434475565432459,18445975951903659873,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵PID:3252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,15246434475565432459,18445975951903659873,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,15246434475565432459,18445975951903659873,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:82⤵PID:2056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15246434475565432459,18445975951903659873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:4116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15246434475565432459,18445975951903659873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15246434475565432459,18445975951903659873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:12⤵PID:4364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15246434475565432459,18445975951903659873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:12⤵PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15246434475565432459,18445975951903659873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:12⤵PID:2648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15246434475565432459,18445975951903659873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:12⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15246434475565432459,18445975951903659873,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4672
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4688
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2136
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
- MD5 2a70f1bd4da893a67660d6432970788d
- SHA1 ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
- SHA512 26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
- MD5 fbe1ce4d182aaffb80de94263be1dd35
- SHA1 bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
- SHA512 3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
- Size 20KB
- SHA256 9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
- MD5 b6c8122025aff891940d1d5e1ab95fce
- SHA1 a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
- SHA512 e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10
- SSDEEP 384:kBod/X+YnvYU+f2y2ScAWYl/7UOSVP6/EvI9mzX42MoOxEuF:kBF+i/PvVIOSVi8vSmzXjXY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012
- Size 44KB
- SHA256 1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8
- MD5 88477d32f888c2b8a3f3d98deb460b3d
- SHA1 1fae9ac6c1082fc0426aebe4e683eea9b4ba898c
- SHA512 e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3
- SSDEEP 768:zznaC0S3xL3KmGLYSKhxDefA2ihGqfz9fNfh0QqdgDnqQpvSjCQNs9f9wAcCGI:PnajS3x3K1JKPCwhLfZdh0Qq6dQNef9x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 216B
- SHA256 55442c211c198c65732301986c47e02deb4874cacbd1a641b309067929dae81f
- MD5 bd9003ecc27e3596b02b4358a1eb0b32
- SHA1 d4801430e0fbc4bc45ead4a07a35412415def337
- SHA512 d11767e81971dd869f581bba82bb99a72bea1c4b3099c4350938740a5131906eb26466faaaea2dabd165ab7c9cb453331f272f9aee96311116ad371318c3d6f2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 240B
- SHA256 7b0376240bce5af9327182f9948c0c3e92350209e4b4b5bdd62834a45511241c
- MD5 c5b95b7355a39de229b274c5e091875d
- SHA1 523b457a613ff306c69bfc94442101998f90ca63
- SHA512 4fb778128032816218a16f735bb0976e2f338ba2005646646ae7c6c74d44ac7b2ffa158f93fd8e9defde423e9196e77e8842208079801b7b9fff936c7bbf1b81
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 2KB
- SHA256 6decdfc38ef4352bfe7b6394cdb784be26e5fb797b69fc53ce6521caf468403d
- MD5 2fb62ffd513ef7b048299a06fe3e3fa2
- SHA1 360bf4938f138b6e4d31efc7c6fe5fe40603e7f6
- SHA512 238f500b9cd5d23b560ad265e0cd90b67b13379a632e79c449ad5969bc06748411e60e3592fd675b850b6957359a16623738cb87d915c52ecc845870ef0a5b2c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 7KB
- SHA256 f366beb41baaf4b1f0cca4de1fb814a77279708b07d84989ebbc409e6c13394d
- MD5 7cf0cdf8935511c9f20b64602b116c81
- SHA1 56551b9c1b68414512bfb1ef7612d94f1d3d0986
- SHA512 17bd6e21f806cfe5f39b35b946ebdb6f0f8e8ba7842b99f90034a59d841946ed8a67c0d7b3974d85564a4b95b39c261adaa75c67bb44050014c92bef4678979a
- SSDEEP 192:nXTkeGEJaEkGWM2AlOR+xaGVfTkMnPYEMlmzqeK5xiw2b2BFrV:nXTFGEJaERW7sI4NFTVPfi8340H2Bj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 4d1f986ca7cdb58c522a6edb367a10fecce1febebb8ac2b2fc92abc18e81ef5d
- MD5 def338c2cc8cc5334e44a5791e62830c
- SHA1 c93230d896db25d539c606f378929520b983ed75
- SHA512 92237db94c53c7bc854a83ad9ff15161ed51e07e40889db8010d77ebf56ad87b5a7dce1507a1866bd1598ecc74a31958ec814878e9013886b1c2fa0428f65f1c
- SSDEEP 96:nXTk7nG1iJaJniK1wpvWMoiVmdeHdt7yBFUWQyV+VDCziEwb:nXTkDGEJawkGWMXb2BFro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 1dd76745eaf7d38e89d1c8c0e5622c8a80f65adebd9d712b79c46238a01dd53e
- MD5 28d2ed54ad53f5df063ad8d74233599f
- SHA1 46f340d1d8cd9344e21deec05f02cf7e217c62d4
- SHA512 d7967aaeca30f5a6489dae3bf9913359b73d9f415646b3e4b6c506a576dec87f36284c7212bcec8db3b679ef7a969e6ad12cba94a39b9b6540abf70a46749b56
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupBBcA/Se2RU9jeOiWE+OblV:A9iIxuERzA83h09RZxYL/sQjsWE/XDaQ
- MD5 SHA1 SHA512 SSDEEP