Analysis
- max time kernel
145s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
07/05/2024, 20:01
Static task
static1
Behavioral task
behavioral1
Sample
2183b7917b05279a75862e7c0bfe6db1_JaffaCakes118.html
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2183b7917b05279a75862e7c0bfe6db1_JaffaCakes118.html
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2183b7917b05279a75862e7c0bfe6db1_JaffaCakes118.html
- Size 138KB
- Sample240507-yry7qsdb5s
- SHA256 add3a8da52f9e014ed1fc66967b4a72d6436d8973600a5a514b564533a627598
- MD5 2183b7917b05279a75862e7c0bfe6db1
- SHA1 63a73997492da7e1ef96c14e2d19d5e9a1a23c2d
- SHA512 cd14cecc0ed542057373cda71c28a8dd047e2648c416c495afcdc3881e4963a6fae712f59d526d3792d46f44dfedbe2ef0fd3aae60b900751ca31078bbcaace8
- SSDEEP 3072:SBeirECrMataCyfkMY+BES09JXAnyrZalI+YQ:SBesMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5068 msedge.exe 5068 msedge.exe 4800 msedge.exe 4800 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4800 msedge.exe 4800 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4800 wrote to memory of 1240 4800 msedge.exe 83 PID 4800 wrote to memory of 1240 4800 msedge.exe 83 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 2984 4800 msedge.exe 84 PID 4800 wrote to memory of 5068 4800 msedge.exe 85 PID 4800 wrote to memory of 5068 4800 msedge.exe 85 PID 4800 wrote to memory of 4500 4800 msedge.exe 86 PID 4800 wrote to memory of 4500 4800 msedge.exe 86 PID 4800 wrote to memory of 4500 4800 msedge.exe 86 PID 4800 wrote to memory of 4500 4800 msedge.exe 86 PID 4800 wrote to memory of 4500 4800 msedge.exe 86 PID 4800 wrote to memory of 4500 4800 msedge.exe 86 PID 4800 wrote to memory of 4500 4800 msedge.exe 86 PID 4800 wrote to memory of 4500 4800 msedge.exe 86 PID 4800 wrote to memory of 4500 4800 msedge.exe 86 PID 4800 wrote to memory of 4500 4800 msedge.exe 86 PID 4800 wrote to memory of 4500 4800 msedge.exe 86 PID 4800 wrote to memory of 4500 4800 msedge.exe 86 PID 4800 wrote to memory of 4500 4800 msedge.exe 86 PID 4800 wrote to memory of 4500 4800 msedge.exe 86 PID 4800 wrote to memory of 4500 4800 msedge.exe 86 PID 4800 wrote to memory of 4500 4800 msedge.exe 86 PID 4800 wrote to memory of 4500 4800 msedge.exe 86 PID 4800 wrote to memory of 4500 4800 msedge.exe 86 PID 4800 wrote to memory of 4500 4800 msedge.exe 86 PID 4800 wrote to memory of 4500 4800 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2183b7917b05279a75862e7c0bfe6db1_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe39fc46f8,0x7ffe39fc4708,0x7ffe39fc47182⤵PID:1240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16085475123004292629,1023453871038183611,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:2984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16085475123004292629,1023453871038183611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,16085475123004292629,1023453871038183611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16085475123004292629,1023453871038183611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:1744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16085475123004292629,1023453871038183611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:3252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16085475123004292629,1023453871038183611,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2996 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4692
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4396
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2
- MD5 8b2290ca03b4ca5fe52d82550c7e7d69
- SHA1 20583a7851a906444204ce8ba4fa51153e6cd494
- SHA512 704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141
- MD5 919c29d42fb6034fee2f5de14d573c63
- SHA1 24a2e1042347b3853344157239bde3ed699047a8
- SHA512 bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 a98b0e8d6598fb0fb28b25bf537132f0cb144354c822a637169880b43102a8bd
- MD5 a2b8c05cca3c8cef5d3993bbfdd8e383
- SHA1 ce03b721c21ccab8612382ff61c80d1dea21aac3
- SHA512 39b3749495a56554a8ba309a7fef1a34802afca09100fb22fb3f94a93dd93c874110142d1c1863466cde74b7d6c951f77935d226dd3e1c38e037aaba4fa0a7c7
- SSDEEP 96:nKkhZ1lFj12wpvWMoiVmdeHuwuFUWQyV+VDCziEwb:nKk39EGWMXF2ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c9de53d1-18c8-414a-9c85-b7d37154b03e.tmp
- Size 6KB
- SHA256 45316b4db5dab9048d0a0cb32e99fcd047c7a385d766d3c4ede368f3390f86dc
- MD5 ae1eba139522e95e5be764c4a21b7ad6
- SHA1 adcbf06b0100a69e1382fcfca7f403a775c6ec2f
- SHA512 ae89daa9fd0a25c7a5d19c7d186c279c853fbaa1cf17d2c28e9ab84b2fa797a4165150aadbe679e0b6493aa4aea73478904ee86a18cd72c5c2c38da92f3c3454
- SSDEEP 96:nKksZ1lFy12wpvWMoiVmdeHuwuFUWQyV+VDCAiEwb:nKkM9pGWMXF2rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 c669aab42dccb07becc275a9f4008e311416f449965dcba34bf51e8bb45d58dc
- MD5 5d020d499d724e79490cb5de281d0280
- SHA1 586ac663739aa8896ea1255688718c6fc5473db0
- SHA512 3bedfef04a2fad55b7ff30c1551831f9366a528878c6a495648b11107fed10e23901fface59f1f1f51c16b9bf760b9f0575d816e2432c89d724ef0788632f531
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup07Me2RU3/Iz3+OblfBhDa8:A9iIxuERzA83h09RZxY07SOG3/XDafEV
- MD5 SHA1 SHA512 SSDEEP