Analysis
- max time kernel
145s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
05/05/2024, 16:48
Static task
static1
Behavioral task
behavioral1
Sample
1887c995b17d39900e1ccc2d57a1b590_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
1887c995b17d39900e1ccc2d57a1b590_JaffaCakes118.html
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 1887c995b17d39900e1ccc2d57a1b590_JaffaCakes118.html
- Size 158KB
- Sample240505-vbj64aad76
- SHA256 29d072dbcb909c865da69ba9e39272601d4f1b323c943f33ed07efe75a895c02
- MD5 1887c995b17d39900e1ccc2d57a1b590
- SHA1 4b1df72133c46f2fe70cedf86d4e02488923a786
- SHA512 483a6d2e87a8a695f878268ecde8cfbb0fe44203a275377268036a9c3d6753537f680e641f9fc79fd55cf3ad456a7c5487aa2b32c3343ebec562814625fa4ccc
- SSDEEP 1536:ipRTpmg8C0HFW40yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:iPKt70yfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1700 msedge.exe 1700 msedge.exe 2404 msedge.exe 2404 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2404 msedge.exe 2404 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe 2404 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2404 wrote to memory of 3676 2404 msedge.exe 83 PID 2404 wrote to memory of 3676 2404 msedge.exe 83 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 4180 2404 msedge.exe 84 PID 2404 wrote to memory of 1700 2404 msedge.exe 85 PID 2404 wrote to memory of 1700 2404 msedge.exe 85 PID 2404 wrote to memory of 2172 2404 msedge.exe 86 PID 2404 wrote to memory of 2172 2404 msedge.exe 86 PID 2404 wrote to memory of 2172 2404 msedge.exe 86 PID 2404 wrote to memory of 2172 2404 msedge.exe 86 PID 2404 wrote to memory of 2172 2404 msedge.exe 86 PID 2404 wrote to memory of 2172 2404 msedge.exe 86 PID 2404 wrote to memory of 2172 2404 msedge.exe 86 PID 2404 wrote to memory of 2172 2404 msedge.exe 86 PID 2404 wrote to memory of 2172 2404 msedge.exe 86 PID 2404 wrote to memory of 2172 2404 msedge.exe 86 PID 2404 wrote to memory of 2172 2404 msedge.exe 86 PID 2404 wrote to memory of 2172 2404 msedge.exe 86 PID 2404 wrote to memory of 2172 2404 msedge.exe 86 PID 2404 wrote to memory of 2172 2404 msedge.exe 86 PID 2404 wrote to memory of 2172 2404 msedge.exe 86 PID 2404 wrote to memory of 2172 2404 msedge.exe 86 PID 2404 wrote to memory of 2172 2404 msedge.exe 86 PID 2404 wrote to memory of 2172 2404 msedge.exe 86 PID 2404 wrote to memory of 2172 2404 msedge.exe 86 PID 2404 wrote to memory of 2172 2404 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1887c995b17d39900e1ccc2d57a1b590_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe732246f8,0x7ffe73224708,0x7ffe732247182⤵PID:3676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15619814618320418460,3534487315144860865,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:4180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,15619814618320418460,3534487315144860865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,15619814618320418460,3534487315144860865,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:82⤵PID:2172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15619814618320418460,3534487315144860865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15619814618320418460,3534487315144860865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15619814618320418460,3534487315144860865,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4692
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3048
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562
- MD5 dbac49e66219979194c79f1cf1cb3dd1
- SHA1 4ef87804a04d51ae1fac358f92382548b27f62f2
- SHA512 bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452
- MD5 a9e55f5864d6e2afd2fd84e25a3bc228
- SHA1 a5efcff9e3df6252c7fe8535d505235f82aab276
- SHA512 12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 90501ce42dc4550b01a611242b82bbe36eb4e027aaf4e3f503cf80e38e32562a
- MD5 1b69b512995d7e807c7074d7748790b7
- SHA1 4d20c682ffbff769bf95497ce08a6fb3ff11f4f6
- SHA512 7c42be275522d74a17e81d57aca0800299816022c6a3714d13df5aa0a5ccde7f7d3d4663344769456602070b5073acc8c9f431d8b7ef81959343fd0315dfb326
- SSDEEP 96:nmkjzrP1uO/hXwpvWMoiVmdeHZqbUWQyV+VDCziEwb:nmkzc0hXGWMXqro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 c44b4c493116350ec9a04884383251c8acfb9680bc99fc52c064eb4ee02d559f
- MD5 3f7d1d37bfc7cdbd6cd89f1d3c2665cc
- SHA1 5072e6ecdfc519ae14daf5dbcefb0b6f638a13b6
- SHA512 9f2ced3f42415b6a30c80aea194011d75ac1bcdb1d855108908ef3d421077884804b430fb47e911fcc4395ffb0ab84738caf4a7bec0a3f78534c6e1b2d1d1e9d
- SSDEEP 96:nmkjzCP1uF/hXwpvWMoiVmdeHZqbUWQyV+VDCAiEwb:nmkcclhXGWMXqrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 a30839161747b6ca6dd2bbc71ed57cc561a03125c9080811046cdfb98a8e6c9a
- MD5 5922b1b42fb7d1cdde06433e0b0a0d1d
- SHA1 1ca9c0744333e1d302c16a62599681aed6cb54df
- SHA512 8c349a71af1212c6520755c4372f5b5de76beb45d90ea7b016d8e7535485058c641ebe736fecffc3ae5a63c07932db5d2a160c4f3e163acf548c55afc1d71ebd
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupUYcee2RUswqGG+OblfBhDu:A9iIxuERzA83h09RZxYUFA0G/XDafEBQ
- MD5 SHA1 SHA512 SSDEEP