Analysis
- max time kernel
131s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
09/05/2024, 00:22
Static task
static1
Behavioral task
behavioral1
Sample
276b1715a2bf87be78ec2becdc8e542f_JaffaCakes118.html
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
276b1715a2bf87be78ec2becdc8e542f_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 276b1715a2bf87be78ec2becdc8e542f_JaffaCakes118.html
- Size 92KB
- Sample240509-apehjsga41
- SHA256 1a549b4c0ca86c667c9c8ec3fac8dc8431a75e2edf0079ea472f36e07c3c396f
- MD5 276b1715a2bf87be78ec2becdc8e542f
- SHA1 b9e75a2d6162ce89e5af8eab765dbb38a6859364
- SHA512 b592cec44b5c9feb1be90f6e91690363f619c37e281dcef5ad94f3e27380ba80647c04377d367b8b7dcb360913ff224dc442c2ef29bc236ef90624812a0e6cca
- SSDEEP 1536:h6Ob+Wiw1Q5HvYGod2hjN+IVKFR2494komiPJ7rvqtMDMyzh7d9w:h6OSWiYQ5HvYGod2hR9VKFR24ekOvqtP
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1836 msedge.exe 1836 msedge.exe 1224 msedge.exe 1224 msedge.exe 1424 msedge.exe 1424 msedge.exe 1424 msedge.exe 1424 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe 1224 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1224 wrote to memory of 4876 1224 msedge.exe 83 PID 1224 wrote to memory of 4876 1224 msedge.exe 83 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 4836 1224 msedge.exe 84 PID 1224 wrote to memory of 1836 1224 msedge.exe 85 PID 1224 wrote to memory of 1836 1224 msedge.exe 85 PID 1224 wrote to memory of 1644 1224 msedge.exe 86 PID 1224 wrote to memory of 1644 1224 msedge.exe 86 PID 1224 wrote to memory of 1644 1224 msedge.exe 86 PID 1224 wrote to memory of 1644 1224 msedge.exe 86 PID 1224 wrote to memory of 1644 1224 msedge.exe 86 PID 1224 wrote to memory of 1644 1224 msedge.exe 86 PID 1224 wrote to memory of 1644 1224 msedge.exe 86 PID 1224 wrote to memory of 1644 1224 msedge.exe 86 PID 1224 wrote to memory of 1644 1224 msedge.exe 86 PID 1224 wrote to memory of 1644 1224 msedge.exe 86 PID 1224 wrote to memory of 1644 1224 msedge.exe 86 PID 1224 wrote to memory of 1644 1224 msedge.exe 86 PID 1224 wrote to memory of 1644 1224 msedge.exe 86 PID 1224 wrote to memory of 1644 1224 msedge.exe 86 PID 1224 wrote to memory of 1644 1224 msedge.exe 86 PID 1224 wrote to memory of 1644 1224 msedge.exe 86 PID 1224 wrote to memory of 1644 1224 msedge.exe 86 PID 1224 wrote to memory of 1644 1224 msedge.exe 86 PID 1224 wrote to memory of 1644 1224 msedge.exe 86 PID 1224 wrote to memory of 1644 1224 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\276b1715a2bf87be78ec2becdc8e542f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff9849246f8,0x7ff984924708,0x7ff9849247182⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15573294173366438386,11554940691168310652,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:4836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,15573294173366438386,11554940691168310652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,15573294173366438386,11554940691168310652,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:82⤵PID:1644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15573294173366438386,11554940691168310652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:2420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15573294173366438386,11554940691168310652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15573294173366438386,11554940691168310652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:2364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15573294173366438386,11554940691168310652,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15573294173366438386,11554940691168310652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:12⤵PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15573294173366438386,11554940691168310652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:12⤵PID:1672
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3960
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3292
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
- MD5 ae54e9db2e89f2c54da8cc0bfcbd26bd
- SHA1 a88af6c673609ecbc51a1a60dfbc8577830d2b5d
- SHA512 e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
- MD5 f53207a5ca2ef5c7e976cbb3cb26d870
- SHA1 49a8cc44f53da77bb3dfb36fc7676ed54675db43
- SHA512 be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 96B
- SHA256 7f2ea33beb0a20b6953e1fbd8f8583524a4598b1beb321e8cd90ffa6b100ddd6
- MD5 d328c42a5087bbe27713bfa8517ec6b2
- SHA1 fcdd7de8c5ed1373f06351e9db87f68f7e21b44a
- SHA512 b3906fe11c52a56e1a5cd916d87f33dfeab92c40623c2933424877aea37bd4736c47c6c2d70eb1229a321121792abe09988dcca3ecb6c99a89371117f695fdb6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 1KB
- SHA256 b75f695547c4be6efc2a93008e1b590a29e5eba584c30411aaf97c4c16cd9c45
- MD5 2dc5af8ba15ec1c5f971a35b39fc56a9
- SHA1 9ce4ca641bf5e7fdc96c8838352565194745a0a6
- SHA512 c154593ad14faf38543b29a7e91d6495ed7127b252aabb2de682344fc0e4ed2706403e817b3002de73931a0c7431e42a9231d9d063d048c6c4ec052a9e5c9a09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 3cdb0fbda9d204e29c004c1620abedc96b6d60ce127e68bfe221519f037cc24a
- MD5 552ed8d588044146d56586328a69cefd
- SHA1 01fd2185b10af639ba152b95baaabaaa3ccabaaa
- SHA512 8c992c13dc02da52dbd1c422f1dfa431fcaaa19c8c362358725c01fcabf2de7e9f6ca31797ffd9f926a792df426dd0ca94ff1f3b9619763642db0e0b9364b24a
- SSDEEP 96:nQkHlY1TPe8wpvWMoiVmdeHpw8EiAAUWQyV+VDCziEwb:nQkKdPe8GWMXpwxAro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 7KB
- SHA256 844ea6b9bc3f60839d69f4b259db93e2182eae04ac0c4660fa59a324975e5c5d
- MD5 07bf7ce55aa1beef75046fa58725c1ee
- SHA1 f53675b81ef34e4274dbbc486bd7141141c22b4d
- SHA512 dcbac982c5a36d039a214c1a0fcfd7e5d37817f21be28ebcddaf8dc3c6aee061b15a325c0b3b919d13b6c0de8e3b9bb3dd7a3ed6e0eba752014a63d17fbe5746
- SSDEEP 96:nQkelY1T/e8wpvWMoiVmdeHsDwFIlrEkj2pw8viAAUWQyV+VDCAiEwb:nQkFd/e8GWM3sDwFIlrEkj2pwcArV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 e0362235957790558ba0ee748deb01fbaf3682d3d6b0767f88ea5f42ca4d4912
- MD5 c7788fb0fd880669cb4482726dd83514
- SHA1 33d20c921d48e241f019e43dfce493ff4f47bb7c
- SHA512 c4ab857bcd825ccf961927f9f671cbb7f4860bed2779ed2237f53e41765df98bc71cb2a4aba09ea4fd21e767016ebfd3d9d7a403c9d18767ebcdea845bd924c6
- SSDEEP 96:nQkelY1TPe8wpvWMoiVmdeHsDwFrEkj2pw8EiAAUWQyV+VDCAiEwb:nQkFdPe8GWM3sDwFrEkj2pwxArV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 06f701322f30ff73feb3265505c97959c8e79608524b086a388b4712fbe417c2
- MD5 0481f3dc11574a15cdf783e343dad77c
- SHA1 483bab96b0a2d2844b735523aee27f579de170f3
- SHA512 fcb3a959d1678bca44a0c9c3d65b6b4bc73269648624380a8f3777afdb98571c4efde5aec30c9d91ba507eeccc956299f302138d4dbdf46a2c8c32aa6152529e
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfMse2RUgA/J+kZ/+OblfBI:A9iIxuERzA83h09RZxYf/AxZ//XDafEy
- MD5 SHA1 SHA512 SSDEEP