Analysis
- max time kernel
145s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
05/05/2024, 08:31
Static task
static1
Behavioral task
behavioral1
Sample
16d5b7220311707fc70afbd758d17e15_JaffaCakes118.html
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
16d5b7220311707fc70afbd758d17e15_JaffaCakes118.html
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 16d5b7220311707fc70afbd758d17e15_JaffaCakes118.html
- Size 178KB
- Sample240505-ke3shacd2w
- SHA256 8cc041007e209670af39d0e412f1942a5a348e62603e0f0eb5d0aa7e9440f85c
- MD5 16d5b7220311707fc70afbd758d17e15
- SHA1 179f4db10e9b372d8d4a3d550c97d6b03e8af142
- SHA512 496a491466726603c172903d5961dcff918780da76652f43bb6199ae92bc979a295aea7159104d4d51de853d73d2967e026a891f87b61096f2e0273913982494
- SSDEEP 3072:1iLApodNhl82jF9a4ckcDt8aNO/Mh6fwLSqbvdm2U4o6297wlGVzXjxE/t1ux:oBF9a4ckcDt8aNO/MhZIfx
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1596 msedge.exe 1596 msedge.exe 216 msedge.exe 216 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 216 msedge.exe 216 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 216 wrote to memory of 2212 216 msedge.exe 85 PID 216 wrote to memory of 2212 216 msedge.exe 85 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1004 216 msedge.exe 86 PID 216 wrote to memory of 1596 216 msedge.exe 87 PID 216 wrote to memory of 1596 216 msedge.exe 87 PID 216 wrote to memory of 5092 216 msedge.exe 88 PID 216 wrote to memory of 5092 216 msedge.exe 88 PID 216 wrote to memory of 5092 216 msedge.exe 88 PID 216 wrote to memory of 5092 216 msedge.exe 88 PID 216 wrote to memory of 5092 216 msedge.exe 88 PID 216 wrote to memory of 5092 216 msedge.exe 88 PID 216 wrote to memory of 5092 216 msedge.exe 88 PID 216 wrote to memory of 5092 216 msedge.exe 88 PID 216 wrote to memory of 5092 216 msedge.exe 88 PID 216 wrote to memory of 5092 216 msedge.exe 88 PID 216 wrote to memory of 5092 216 msedge.exe 88 PID 216 wrote to memory of 5092 216 msedge.exe 88 PID 216 wrote to memory of 5092 216 msedge.exe 88 PID 216 wrote to memory of 5092 216 msedge.exe 88 PID 216 wrote to memory of 5092 216 msedge.exe 88 PID 216 wrote to memory of 5092 216 msedge.exe 88 PID 216 wrote to memory of 5092 216 msedge.exe 88 PID 216 wrote to memory of 5092 216 msedge.exe 88 PID 216 wrote to memory of 5092 216 msedge.exe 88 PID 216 wrote to memory of 5092 216 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\16d5b7220311707fc70afbd758d17e15_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99d5a46f8,0x7ff99d5a4708,0x7ff99d5a47182⤵PID:2212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,17408222657737936811,15484607238038689299,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:1004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,17408222657737936811,15484607238038689299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,17408222657737936811,15484607238038689299,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17408222657737936811,15484607238038689299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17408222657737936811,15484607238038689299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:3936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,17408222657737936811,15484607238038689299,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2900 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4016
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4672
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3584
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
- MD5 2a70f1bd4da893a67660d6432970788d
- SHA1 ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
- SHA512 26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
- MD5 fbe1ce4d182aaffb80de94263be1dd35
- SHA1 bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
- SHA512 3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 1KB
- SHA256 0d49883dd706fcebedc2d44b6ca643c9c55258c2e68981a7d730e4c87dcc26f6
- MD5 9514163d45642dba9bada4969317a46b
- SHA1 069189615cf1f03d8fcac95afaddc9bb5e2626bc
- SHA512 537804512ace5f6662b4bac57ef397ab70168e3d676a19b41e9a2ab0216f6a547e9d5bf384b9a141643a6f6bbf4c8cc98c30c5e9ccb51dc969425f9be2718c82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 c68bd20aad4b965a624429d060087d953fdf35c119b6322c29e725950ba2d1f1
- MD5 33dce36139530dda549dee8df58b55da
- SHA1 6b621cfc46bba56668fd9b62361e7d5339825c6c
- SHA512 88a66279b7b2be0d38f32ce0e914429e81b5afcf12793cc686a6b41764bfc50a98b160c62f69c99cb8aae2f7878ad5606dc32dd96879ba487df463791b2faa54
- SSDEEP 96:nXkbS1r++niK1wpvWMoiVmdeHdt7u+UWQyV+VDCziEwb:nXkmExkGWMXb6+ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 6c01231ecc0b6d9a93ab54742963c0c714d75ed4f1236435d87d00b4fea405cc
- MD5 9a6f4f3338d928ec61c5e5cadfec26a5
- SHA1 198d0c1fb2ff3289f162ebf3585e9c29cfe3e84f
- SHA512 09030b679482c49f6ad6c9b4c502ea85ef845378fc1c372752b81648a1dc1a82619503a1c85949f70d14b120f2fbf5f532d8a1af002db0b9e012ae769fee0d0d
- SSDEEP 96:nXkSS1r++niK1wpvWMoiVmdevakP6g92dt7u+UWQyV+VDCAiEwb:nXkVExkGWMfakPL92b6+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 be6084b1863e6906a01f31b13cf7d4b30541d5adfa4bf2af8ff2b2e1067aeaaa
- MD5 895d5e4d06f12c8be4bebb3455958759
- SHA1 34d20bb319bc000ab58b02a02956b34867ac7f47
- SHA512 9bff98fef1fa03297145ef29b27050d18fe42eb1b6ce512b376327067a7b4d5b41e2dc00836d57239b9d624ff5a7206a3bb4fad3faef212b2e2f6b07cedb729f
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupgBcFe2RUtdOiv+OblfBhDW:A9iIxuERzA83h09RZxYP0/v/XDafEBoL
- MD5 SHA1 SHA512 SSDEEP