Analysis
- max time kernel
120s - max time network
108s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
09/05/2024, 18:48
Static task
static1
Behavioral task
behavioral1
Sample
2b6109100896df7dc3c6249dbc8402df_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2b6109100896df7dc3c6249dbc8402df_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2b6109100896df7dc3c6249dbc8402df_JaffaCakes118.html
- Size 247KB
- Sample240509-xftbnscd29
- SHA256 f520c2a574de64589bc2b1b00b7f2270db904f8791734848315de3aa87255f6e
- MD5 2b6109100896df7dc3c6249dbc8402df
- SHA1 49830ab3dc99413b4cb2baf95e9570e671213562
- SHA512 1b8051a202eaf9d9671eb1110afc07d2b2e80e7d87c2094a2b6656ab0cb1a71676a53ae5c9b7ee00305c3d34b3baf0adc1b622ae670e05e4460a4a5c0d22e42c
- SSDEEP 6144:vIoEkocFhRNFnSQI3nWJ7vFq3+Ybt8aN1h1fGp7w+wyTdT:wodoc5NFnSQI3nWJ7vFq3+Yp8aN1h1fU
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2824 msedge.exe 2824 msedge.exe 5028 msedge.exe 5028 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5028 msedge.exe 5028 msedge.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5028 wrote to memory of 2388 5028 msedge.exe 82 PID 5028 wrote to memory of 2388 5028 msedge.exe 82 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 1236 5028 msedge.exe 84 PID 5028 wrote to memory of 2824 5028 msedge.exe 85 PID 5028 wrote to memory of 2824 5028 msedge.exe 85 PID 5028 wrote to memory of 3784 5028 msedge.exe 86 PID 5028 wrote to memory of 3784 5028 msedge.exe 86 PID 5028 wrote to memory of 3784 5028 msedge.exe 86 PID 5028 wrote to memory of 3784 5028 msedge.exe 86 PID 5028 wrote to memory of 3784 5028 msedge.exe 86 PID 5028 wrote to memory of 3784 5028 msedge.exe 86 PID 5028 wrote to memory of 3784 5028 msedge.exe 86 PID 5028 wrote to memory of 3784 5028 msedge.exe 86 PID 5028 wrote to memory of 3784 5028 msedge.exe 86 PID 5028 wrote to memory of 3784 5028 msedge.exe 86 PID 5028 wrote to memory of 3784 5028 msedge.exe 86 PID 5028 wrote to memory of 3784 5028 msedge.exe 86 PID 5028 wrote to memory of 3784 5028 msedge.exe 86 PID 5028 wrote to memory of 3784 5028 msedge.exe 86 PID 5028 wrote to memory of 3784 5028 msedge.exe 86 PID 5028 wrote to memory of 3784 5028 msedge.exe 86 PID 5028 wrote to memory of 3784 5028 msedge.exe 86 PID 5028 wrote to memory of 3784 5028 msedge.exe 86 PID 5028 wrote to memory of 3784 5028 msedge.exe 86 PID 5028 wrote to memory of 3784 5028 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2b6109100896df7dc3c6249dbc8402df_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef94246f8,0x7ffef9424708,0x7ffef94247182⤵PID:2388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14992461274695056617,3106922213225910613,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵PID:1236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,14992461274695056617,3106922213225910613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,14992461274695056617,3106922213225910613,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:82⤵PID:3784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14992461274695056617,3106922213225910613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:12⤵PID:3232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14992461274695056617,3106922213225910613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:12⤵PID:5096
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1376
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
- MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
- SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
- SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
- MD5 87f7abeb82600e1e640b843ad50fe0a1
- SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
- SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 1KB
- SHA256 a167b7b2649e9ef443e0c3c293d619eb4f80fad69ef00abf85d4477a96376b04
- MD5 8bcafaa49e4f4e31ac7cd8afc22660dd
- SHA1 cea267b6c6db63cf55a2ad16b09392893b28a189
- SHA512 9c6bb099b4cf36107e438a2ce0cfcaced3f4b0d1d984fd2d9fa64b6825cfda97ab97271918e59e88373a5cd5d752f6b34424a1d69fb4d338c5613c99f074bcdb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 fc58d58420790f0f2783389da2ff4b11fc017a837af1dce47ba83b7bc591be25
- MD5 3e54541e26fb203122c2f3a5d211c183
- SHA1 58c3c25f5933517fd47663c53ef704bdf6593cad
- SHA512 9d0133974a6cc0b9a9b7c198c2c4867e31c95616a54c8803e2076b42f30b9090f2740bf1095b670bc584a45975cbef11771c1c41d09c6b53798e19b6dc181f8f
- SSDEEP 96:n8kxxm/pQYmqe1sj0wpvWMoiVmdeH/zwFUWQyV+VDCziEwb:n8kKC5eQGWMXUro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 7KB
- SHA256 58fa9d8445089d8fbcaedd05b54ee74ac78a02ff22a19592007c0774627d9354
- MD5 417c8044a9b1626707d850b3a664dccd
- SHA1 a8379e3108f34a7c8ecadb6859a76eddc7f8897a
- SHA512 fb445d0ee05ab7d8412b8edc4d1ce738428dc691f642a41510a86464a9c2248e2b655776c12be0f49ff04b076e51b2a47f8689003e24748388edf582826019d8
- SSDEEP 96:n8knxm/pnmqe1sWNG0wpvWMoiVmdege35aTNc9e2/3v6zyWQyV+VDCAiEwb:n8ksw5eWNVGWMQe35aTNc9e24lV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 7KB
- SHA256 d3862f8768ffeaf364d01b906a2ff56c051ed1f08e49b26438d5727e685b3cf1
- MD5 5b7651c8534fb7478546782462a994a1
- SHA1 a81b14f4dfb96e151613e641bc2b199978a5a225
- SHA512 bd503d2a4e9694c4f85cb08c92173672adb9eb5c8f4098ff0f90a8cbbaaba6ed8af169fa7d625e1ffff7089893aabb9fec92d424ed0464ca4d67234ec46bf464
- SSDEEP 96:n8kxxm/pnmqe1sj0wpvWMoiVmdege35aTNc9e2/zwFUWQyV+VDCAiEwb:n8kKw5eQGWMQe35aTNc9e2UrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 214046386496e0eb4caaa056bbc201912f4ab0e3d68f9d534717b74d4291f9ae
- MD5 9f191e93ad37c3bc64a1650f23d5fbaf
- SHA1 ba39eb483729f53ab4c9381f16bf9189a6036b78
- SHA512 f1def9959b6edd0ee6c38957763159afb23f1975cb97f6be85dd72d6203a28db9ed15d56817f2e1984ade0fe7a4599d198cdf9c2432e24fa7316ecce934d9d84
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupPvPe2RU0my3+OblfBhDaa7:A9iIxuERzA83h09RZxYn373/XDafEBfz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 c20c90126c8eb594e1a7878b974a038cdda932a859caf72765065c2924eac8d1
- MD5 523782206b1383e47889c2aea4d33497
- SHA1 f43522748e4153d4243952b060dbf478533d7bae
- SHA512 8830d44b91145cf3356d4fb423a55a768d26a381a55a6ce36e773a678b059ccb48d1444f263e0c5e77c2e4158d842171b7dea06510d0e7095ccf06a430a07a44
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupPvPe2RUqmys+OblfBhDaa7:A9iIxuERzA83h09RZxYn3Hs/XDafEBfz
- MD5 SHA1 SHA512 SSDEEP