Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
05/05/2024, 09:47
Static task
static1
Behavioral task
behavioral1
Sample
1718e29cb7532ed0f02e150907f70924_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
1718e29cb7532ed0f02e150907f70924_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 1718e29cb7532ed0f02e150907f70924_JaffaCakes118.html
- Size 139KB
- Sample240505-lr98sahf83
- SHA256 6a0c144b7ae0d7003b8b88431196c8fe4f098ec2ac59f07682850699a68f0f54
- MD5 1718e29cb7532ed0f02e150907f70924
- SHA1 f169f81e09cdfb26e27ee989f44ddf81c0b0e058
- SHA512 2a8322670872c0053209fc8192a704f00f7c3a5825a9f43444e955ddbff045033c2331a5dd8b34e8c8731ebf0f26582ebd4c047a8ce3ddf1e84bae09aed8fe44
- SSDEEP 1536:SxdF04ysRlmyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:Sx84ysqyfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1292 msedge.exe 1292 msedge.exe 5116 msedge.exe 5116 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5116 msedge.exe 5116 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5116 wrote to memory of 624 5116 msedge.exe 83 PID 5116 wrote to memory of 624 5116 msedge.exe 83 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1656 5116 msedge.exe 84 PID 5116 wrote to memory of 1292 5116 msedge.exe 85 PID 5116 wrote to memory of 1292 5116 msedge.exe 85 PID 5116 wrote to memory of 3744 5116 msedge.exe 86 PID 5116 wrote to memory of 3744 5116 msedge.exe 86 PID 5116 wrote to memory of 3744 5116 msedge.exe 86 PID 5116 wrote to memory of 3744 5116 msedge.exe 86 PID 5116 wrote to memory of 3744 5116 msedge.exe 86 PID 5116 wrote to memory of 3744 5116 msedge.exe 86 PID 5116 wrote to memory of 3744 5116 msedge.exe 86 PID 5116 wrote to memory of 3744 5116 msedge.exe 86 PID 5116 wrote to memory of 3744 5116 msedge.exe 86 PID 5116 wrote to memory of 3744 5116 msedge.exe 86 PID 5116 wrote to memory of 3744 5116 msedge.exe 86 PID 5116 wrote to memory of 3744 5116 msedge.exe 86 PID 5116 wrote to memory of 3744 5116 msedge.exe 86 PID 5116 wrote to memory of 3744 5116 msedge.exe 86 PID 5116 wrote to memory of 3744 5116 msedge.exe 86 PID 5116 wrote to memory of 3744 5116 msedge.exe 86 PID 5116 wrote to memory of 3744 5116 msedge.exe 86 PID 5116 wrote to memory of 3744 5116 msedge.exe 86 PID 5116 wrote to memory of 3744 5116 msedge.exe 86 PID 5116 wrote to memory of 3744 5116 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1718e29cb7532ed0f02e150907f70924_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d51846f8,0x7ff8d5184708,0x7ff8d51847182⤵PID:624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12779155211147519797,1421230072174578164,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:1656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,12779155211147519797,1421230072174578164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,12779155211147519797,1421230072174578164,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:82⤵PID:3744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12779155211147519797,1421230072174578164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12779155211147519797,1421230072174578164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12779155211147519797,1421230072174578164,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1292 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4080
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4388
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
- MD5 4f7152bc5a1a715ef481e37d1c791959
- SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
- SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
- MD5 ea98e583ad99df195d29aa066204ab56
- SHA1 f89398664af0179641aa0138b337097b617cb2db
- SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 34c60efbf4aef77bb57fcafec4ef31d9f158342eb925ad08e409bd2b9fcc3794
- MD5 8ed2c60b835c60c6c27c8ed93bb27d94
- SHA1 f2192e262e015d031d3f40e6623823e819bcd6dc
- SHA512 54d4dc5ac885bd738534e8ecc9fe52fd9bbf57c7df2c10e96ece702da19119cbe3aa6c76065462bae49d1591ba67c2209b37ca8bacbd14b5a0e33d348a052e13
- SSDEEP 96:nykYxm/eQYmqR1233XwpvWMoiVmdeHp1ka3UWQyV+VDCziEwb:nykZH6knXGWMXpn3ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 a451ee00cc86eb058d2db58aa370e5c62a47553483fdd5835acde3e1b10dc405
- MD5 cd406df57fb88209454e6de42c592770
- SHA1 8edac5a796d95869c89685c612972420bc0eb950
- SHA512 d19789f6b2b9abeb0a77348464d8a45e3610a2f9c9b1d038173f702f0fbe3caa4a28a0fe04f39523963f4093c0b65f07fe357068b9e5463b53fed8194bac7ed1
- SSDEEP 96:nykYxm/enmqR12U3XwpvWMoiVmdeHp1ka3UWQyV+VDCAiEwb:nykZZ6kAXGWMXpn3rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 1d58c05466df27d9230cb74ed15933f89497c977e50362f6c5bdeb7e2e825fee
- MD5 5e7fd971ac94cffbac33fe02ecfca931
- SHA1 09c554d4813c266f168875edf434f7a0dd0ac155
- SHA512 542bdaedc94fe8a51c61d102a018880c427dc38b03b690cc701909a23fb88faed8b88c43fd986299daf468b6f03612b43a22bd1ce33b257e3ad4929015538a91
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupG7se2RUid/B5Q+OblfBhDt:A9iIxuERzA83h09RZxYGuVdbQ/XDafEd
- MD5 SHA1 SHA512 SSDEEP