Analysis
- max time kernel
145s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
08/05/2024, 22:41
Static task
static1
Behavioral task
behavioral1
Sample
270f46e37ae838c1dd88f4ab182a4d7a_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
270f46e37ae838c1dd88f4ab182a4d7a_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 270f46e37ae838c1dd88f4ab182a4d7a_JaffaCakes118.html
- Size 226KB
- Sample240508-2mfrdadg88
- SHA256 3ad5561e49c28fa4e5d4702057670468bcb8f978aebbd3c382d0ecf1ede13291
- MD5 270f46e37ae838c1dd88f4ab182a4d7a
- SHA1 f0cc4999cfdb7fbf8454c47002343d4416611ae0
- SHA512 bc2283c21a714678bfec0656cca3d93c553ea5888ec0d9024e2142f56b8923771bc4c0c75bf718d3d91dbc1da34cbaa026bd7db3b0656b4ef842a7fdd997dd38
- SSDEEP 3072:4uzrlT21t8aN3CHD5bswqqE2BHx6ArkWuKQF:4uzr0t8aN3CHD53S
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3260 msedge.exe 3260 msedge.exe 4412 msedge.exe 4412 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4412 wrote to memory of 3368 4412 msedge.exe 83 PID 4412 wrote to memory of 3368 4412 msedge.exe 83 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 4392 4412 msedge.exe 84 PID 4412 wrote to memory of 3260 4412 msedge.exe 85 PID 4412 wrote to memory of 3260 4412 msedge.exe 85 PID 4412 wrote to memory of 3568 4412 msedge.exe 86 PID 4412 wrote to memory of 3568 4412 msedge.exe 86 PID 4412 wrote to memory of 3568 4412 msedge.exe 86 PID 4412 wrote to memory of 3568 4412 msedge.exe 86 PID 4412 wrote to memory of 3568 4412 msedge.exe 86 PID 4412 wrote to memory of 3568 4412 msedge.exe 86 PID 4412 wrote to memory of 3568 4412 msedge.exe 86 PID 4412 wrote to memory of 3568 4412 msedge.exe 86 PID 4412 wrote to memory of 3568 4412 msedge.exe 86 PID 4412 wrote to memory of 3568 4412 msedge.exe 86 PID 4412 wrote to memory of 3568 4412 msedge.exe 86 PID 4412 wrote to memory of 3568 4412 msedge.exe 86 PID 4412 wrote to memory of 3568 4412 msedge.exe 86 PID 4412 wrote to memory of 3568 4412 msedge.exe 86 PID 4412 wrote to memory of 3568 4412 msedge.exe 86 PID 4412 wrote to memory of 3568 4412 msedge.exe 86 PID 4412 wrote to memory of 3568 4412 msedge.exe 86 PID 4412 wrote to memory of 3568 4412 msedge.exe 86 PID 4412 wrote to memory of 3568 4412 msedge.exe 86 PID 4412 wrote to memory of 3568 4412 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\270f46e37ae838c1dd88f4ab182a4d7a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9584f46f8,0x7ff9584f4708,0x7ff9584f47182⤵PID:3368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,9299651165034805776,11421054433396323109,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,9299651165034805776,11421054433396323109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,9299651165034805776,11421054433396323109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:82⤵PID:3568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9299651165034805776,11421054433396323109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:2772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9299651165034805776,11421054433396323109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:3732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9299651165034805776,11421054433396323109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:12⤵PID:1496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9299651165034805776,11421054433396323109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:12⤵PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9299651165034805776,11421054433396323109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,9299651165034805776,11421054433396323109,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5424 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1916
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3544
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7ba1c1fe-41b0-4f99-8d71-301b643bf7aa.tmp
- Size 11KB
- SHA256 0dbe4f0d27eace0fb6922530989fe9779b139d0605cce7e5c6981d22f7879a31
- MD5 dbc62e61a4497f4a2888056f08ddf1a0
- SHA1 e04876d4e1e0c247cf3dfa304962a609068b7583
- SHA512 837a7c0150e7644b9a24901afd35f9fc9cc192010ef8828925d5dc5a91f7e6e343bfefa05f96edb003856c293e849f5fe7e83058923256d0da1de85a339e8cfe
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup7kWe2RUxje7Zt+OblfBhDG:A9iIxuERzA83h09RZxY7k4ooZt/XDafD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
- MD5 1ac52e2503cc26baee4322f02f5b8d9c
- SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
- SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
- MD5 b2a1398f937474c51a48b347387ee36a
- SHA1 922a8567f09e68a04233e84e5919043034635949
- SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
- Size 22KB
- SHA256 bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105
- MD5 5e74c6d871232d6fe5d88711ece1408b
- SHA1 1a5d3ac31e833df4c091f14c94a2ecd1c6294875
- SHA512 9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5
- SSDEEP 384:z5y45znEXC0Kl3/5Lw9MeUrFLMuNrn9GVxEVSYnBvTzlmylDY99v2VQYfoorMEiJ:zznaC0S3xL3KmGLYSKTzlJY99OVQYwAK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
- Size 20KB
- SHA256 9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
- MD5 b6c8122025aff891940d1d5e1ab95fce
- SHA1 a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
- SHA512 e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10
- SSDEEP 384:kBod/X+YnvYU+f2y2ScAWYl/7UOSVP6/EvI9mzX42MoOxEuF:kBF+i/PvVIOSVi8vSmzXjXY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 288B
- SHA256 29073c352e3704a0256ccbfe421a52a09ab147350b83a642d00fa644c95ed39f
- MD5 5199c41c3ef57c5e901bf1e3a5d4c62a
- SHA1 7d3b8826c511f9748a50d8573ec0f8986eabe905
- SHA512 3e03132770f53981b8bf4c69f8b32a21a90c07795ae6edd0e0aa6932b2604debf035b8603c7fc82c9199ffb02f619635a05f2076c791c6244563978513831e86
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 264B
- SHA256 6e9f09c5965e42369070eb11f01038b2ee3d573a950423fff9586b23ad27a63c
- MD5 0b9481bc977c3f557551d6d6bd48e79b
- SHA1 0eb021eeeee2d9da30c2e14edd7f474f990c09eb
- SHA512 e3ebc1bdae12c45a3bbffdafec806807a7237788ba8fbf548f9ce444b4b2714add0a26e647ed4a9f910b6b14f139a95f2a123e899c8514783c4b3173a87401d6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 2KB
- SHA256 2c6e0bfbbf449523c125e810f7a32bc95b5d3e26172ec002df3189aa84dd00b3
- MD5 ea0dbb27f5e21bac5a21a13065259981
- SHA1 710fa4412ea0e447900045b0a900780a3a9225b4
- SHA512 e3ad93f1770989a96c0a20c4d6999df2d554112327b88806d303f97184e1225e9a7142cb13cb0b31987507a80e7000f4fb4f414671e045173c30c496c2f757dc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 7KB
- SHA256 a402cadaf5af0cc70dfd171a1f575b30dc82972938bfb4471b430287437f9409
- MD5 e24e19fec394bc9c3ec52ca6b0154ec8
- SHA1 15ddf5fad7a90a90cbfbe8a8488e68d4fa3f6ecd
- SHA512 e42cef65abf3641c72d83520b063a47f6a6ff5c1605379e3101ccc2f4bf16618636d59bd719ee92470330c85d7edf8207889367548399070e1563c63acf191bf
- SSDEEP 192:nVkZZUQr9aCQGWM/2oN8Rnvmehsb2pcbkYrV:nVlQr9RW6PkQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 f24cee00d8991c85e64cbb889affa7a8714537a684c5e113ae5ef6a20875da62
- MD5 1eaf523357b138ef6005f6bd70255d2f
- SHA1 1e05f7736b34336311ff37dbd8dfe71b83aedb8c
- SHA512 1c81e4567f6deeb0c4887996e390195c25a2dfb7f49a77fa791ebeb823d146a2215956d6ea6c1e774de3c71598f633cd88b805a58f9e4313d4d569a70d671248
- SSDEEP 96:nVkYxm/eQYmqBQ1hega9IQwpvWMoiVmdeHpCrvbkYUWQyV+VDCziEwb:nVkZHUQrNaCQGWMXpcbkYro
- MD5 SHA1 SHA512 SSDEEP