Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
07/05/2024, 03:25
Static task
static1
Behavioral task
behavioral1
Sample
1f4bea2bfa548313c2be433e203a454a_JaffaCakes118.html
Resource
win7-20240220-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
1f4bea2bfa548313c2be433e203a454a_JaffaCakes118.html
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 1f4bea2bfa548313c2be433e203a454a_JaffaCakes118.html
- Size 135KB
- Sample240507-dy27raba28
- SHA256 1e8690a787d02332a6a886f3180341efedbfb2413fe8757b76981f113bd03698
- MD5 1f4bea2bfa548313c2be433e203a454a
- SHA1 48fde69353336c653f1418dd682bb274e532e4a2
- SHA512 3ff373eba22d0466409b07d1586c1c9c301adb76a3980ba49ec9995008cf13fb9b1d0796d061a8b3b39d4b0f11c57d662ac6745e4ef47f8207e72ca060226790
- SSDEEP 1536:SFbHVFjTcZZxRNvDowdl7FXEyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP9:SByfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3880 msedge.exe 3880 msedge.exe 1840 msedge.exe 1840 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1840 msedge.exe 1840 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1840 wrote to memory of 3668 1840 msedge.exe 85 PID 1840 wrote to memory of 3668 1840 msedge.exe 85 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 764 1840 msedge.exe 86 PID 1840 wrote to memory of 3880 1840 msedge.exe 87 PID 1840 wrote to memory of 3880 1840 msedge.exe 87 PID 1840 wrote to memory of 3208 1840 msedge.exe 88 PID 1840 wrote to memory of 3208 1840 msedge.exe 88 PID 1840 wrote to memory of 3208 1840 msedge.exe 88 PID 1840 wrote to memory of 3208 1840 msedge.exe 88 PID 1840 wrote to memory of 3208 1840 msedge.exe 88 PID 1840 wrote to memory of 3208 1840 msedge.exe 88 PID 1840 wrote to memory of 3208 1840 msedge.exe 88 PID 1840 wrote to memory of 3208 1840 msedge.exe 88 PID 1840 wrote to memory of 3208 1840 msedge.exe 88 PID 1840 wrote to memory of 3208 1840 msedge.exe 88 PID 1840 wrote to memory of 3208 1840 msedge.exe 88 PID 1840 wrote to memory of 3208 1840 msedge.exe 88 PID 1840 wrote to memory of 3208 1840 msedge.exe 88 PID 1840 wrote to memory of 3208 1840 msedge.exe 88 PID 1840 wrote to memory of 3208 1840 msedge.exe 88 PID 1840 wrote to memory of 3208 1840 msedge.exe 88 PID 1840 wrote to memory of 3208 1840 msedge.exe 88 PID 1840 wrote to memory of 3208 1840 msedge.exe 88 PID 1840 wrote to memory of 3208 1840 msedge.exe 88 PID 1840 wrote to memory of 3208 1840 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1f4bea2bfa548313c2be433e203a454a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0cad46f8,0x7ffc0cad4708,0x7ffc0cad47182⤵PID:3668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17626162638747361150,17270964577549397732,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,17626162638747361150,17270964577549397732,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,17626162638747361150,17270964577549397732,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:3208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17626162638747361150,17270964577549397732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:4640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17626162638747361150,17270964577549397732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17626162638747361150,17270964577549397732,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4056
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1584
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 8a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32
- MD5 9dc60aef38e7832217e7fa02d6f0d9f6
- SHA1 4f8539dc7d5739b36fe976a932338f459d066db6
- SHA512 18371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700
- MD5 7ac03b15b68af2d5cb5c8063057cc83e
- SHA1 9b2d4db737f57322ff5c4bbddd765b3177f930ab
- SHA512 a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 4ec2c4147236d6e59216c8e177db2c4a2927391f1b4e7c38ac27623081d61014
- MD5 3c6dfb73080006ff8544ae778e44f444
- SHA1 532ca3608718f3c11960f23a23b22c9362615445
- SHA512 8bddf813af52dc66b4c4e4531d99a111537d7689a72fd793b2edcb075b4337079b16e423125d63bee7b819470922f20eef5d36878839e2a027e8c80016c27808
- SSDEEP 96:n0kNf16dj1wpvWMoiVmdeHVyoNUWQyV+VDCziEwb:n0kJIPGWMX3Nro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 690e4a9eb3604684cd1916fe8f9af3645530752eb70dfd86516b4432093029d1
- MD5 af13a820cece05e0d9d74f2f4b92182f
- SHA1 50dc038fcc5f5329afde1692f399ab747e1fb047
- SHA512 d9e09af8f76588c43e5caa359a83fb60c983ff43fbc89417cebdfe4966a35b3f94ace71026490f841e0fdb9feb0b6a616d6a2bba6d90ff45c3af5c5b1bf4e1b3
- SSDEEP 96:n0kIf16sj1wpvWMoiVmdeHVyoNUWQyV+VDCAiEwb:n0kWIWGWMX3NrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 5b44c9ac2a7b53fb8caebac861d50c579f02e1cd265e21c65ae7348c82990957
- MD5 0641b1844aeee71f7609939c0cef8883
- SHA1 8b06ebb23170c08592ada24027a8b9d7e0f8e037
- SHA512 6707a50def927fc5cf68aaef25ef5f6aa710eba9e29eb60d2676a25d16029db9a7537ec07e607a584136faad0e6e698bf83691d73becd919df7bda152caa758e
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupne2RUL/8c7Tik+OblfBhD2:A9iIxuERzA83h09RZxYP2kcfik/XDafn
- MD5 SHA1 SHA512 SSDEEP