Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
10/05/2024, 16:59
Static task
static1
Behavioral task
behavioral1
Sample
301f056f1820636716e104a5f81b5d4a_JaffaCakes118.html
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
301f056f1820636716e104a5f81b5d4a_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 301f056f1820636716e104a5f81b5d4a_JaffaCakes118.html
- Size 142KB
- Sample240510-vhrvhsba56
- SHA256 f52e0eb8aae43b0dacf041b92c7281bd7bd1187df2848cca8290ff9cb3218473
- MD5 301f056f1820636716e104a5f81b5d4a
- SHA1 d7abf36a629661bf639b924d1b9147f62b150c9e
- SHA512 f68c1cca4b14f004e7de267e024b1bc0f612a48f457ad18fe84a0e5e1edd09fdff7b011759f83048817f8fd57b7e79c845a800c3bbb73b993796c99f29d7b352
- SSDEEP 3072:SiUBTf+x7dyfkMY+BES09JXAnyrZalI+YQ:SiUBTmx7osMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2444 msedge.exe 2444 msedge.exe 3856 msedge.exe 3856 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3856 msedge.exe 3856 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe 3856 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3856 wrote to memory of 3260 3856 msedge.exe 82 PID 3856 wrote to memory of 3260 3856 msedge.exe 82 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 4152 3856 msedge.exe 83 PID 3856 wrote to memory of 2444 3856 msedge.exe 84 PID 3856 wrote to memory of 2444 3856 msedge.exe 84 PID 3856 wrote to memory of 656 3856 msedge.exe 85 PID 3856 wrote to memory of 656 3856 msedge.exe 85 PID 3856 wrote to memory of 656 3856 msedge.exe 85 PID 3856 wrote to memory of 656 3856 msedge.exe 85 PID 3856 wrote to memory of 656 3856 msedge.exe 85 PID 3856 wrote to memory of 656 3856 msedge.exe 85 PID 3856 wrote to memory of 656 3856 msedge.exe 85 PID 3856 wrote to memory of 656 3856 msedge.exe 85 PID 3856 wrote to memory of 656 3856 msedge.exe 85 PID 3856 wrote to memory of 656 3856 msedge.exe 85 PID 3856 wrote to memory of 656 3856 msedge.exe 85 PID 3856 wrote to memory of 656 3856 msedge.exe 85 PID 3856 wrote to memory of 656 3856 msedge.exe 85 PID 3856 wrote to memory of 656 3856 msedge.exe 85 PID 3856 wrote to memory of 656 3856 msedge.exe 85 PID 3856 wrote to memory of 656 3856 msedge.exe 85 PID 3856 wrote to memory of 656 3856 msedge.exe 85 PID 3856 wrote to memory of 656 3856 msedge.exe 85 PID 3856 wrote to memory of 656 3856 msedge.exe 85 PID 3856 wrote to memory of 656 3856 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\301f056f1820636716e104a5f81b5d4a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad02946f8,0x7ffad0294708,0x7ffad02947182⤵PID:3260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,13930538940638402139,4898004387296536236,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:22⤵PID:4152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,13930538940638402139,4898004387296536236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,13930538940638402139,4898004387296536236,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:82⤵PID:656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13930538940638402139,4898004387296536236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:1176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13930538940638402139,4898004387296536236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:1852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,13930538940638402139,4898004387296536236,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3476
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4036
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
- MD5 a8e767fd33edd97d306efb6905f93252
- SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
- SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
- MD5 439b5e04ca18c7fb02cf406e6eb24167
- SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
- SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 61f46b45233132d785d40b385f37362890c240b84c4820a233143694d27a4661
- MD5 b0781e231fd154cfc66ecb81724c9809
- SHA1 08b3ffb7b6e3f88382bfe58ee3f90e61210c1b3e
- SHA512 d532f521853eaa9b68b03639c250d51f32e0912a6f130d9597483750bf181d0679cb384930cafd7264510e1e1c086253294f1232cdd03607cb27ca7db7aaac36
- SSDEEP 96:n1klxm/pnmqU13owpvWMoiVmdeHBrzHb+UWQyV+VDCAiEwb:n1kWw7FoGWMXlb+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 373b1c73205262309deb0982b29aa45ff2ef2e0eee68082dc54d5d245567b1fe
- MD5 8a601fd1aef294ffb89e98c7d8bbf45d
- SHA1 bee03392d0d156cb8f5d2c94425d3b3831823eb6
- SHA512 29a957f14b8472c0b0b12a1edc6072d703927a8d35678389d7aee8c0c3ee15d2cad2c4f9baaae05154cd018e4738482f2fb3f4e04468a64a954e53ae1ec284ff
- SSDEEP 96:n1klxm/pQYmqU13twpvWMoiVmdeHBrzHb+UWQyV+VDCziEwb:n1kWC7FtGWMXlb+ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 48078d53d3ffd353f3d4936c367ca184624dce660381340f51be24a5e08aa1aa
- MD5 25d460a4bd5c79a332c521440dd56697
- SHA1 e40e176dde3b4e53a1dc085acd3aadea4f65c28f
- SHA512 f2e8a0d23a76c7f871bd0f17f4c46a356552b33a92adde2374f75fdd910745249d89e0b29f005e384b65f964af210df2606fbe45417c1a5bb757227b3f693ce5
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSHKle2RUJMC2++OblfBhDe:A9iIxuERzA83h09RZxYSHyfd+/XDafEO
- MD5 SHA1 SHA512 SSDEEP