Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
25/05/2024, 02:44
Static task
static1
Behavioral task
behavioral1
Sample
709da2bae156b2f569aed96760fc99d0_JaffaCakes118.html
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
709da2bae156b2f569aed96760fc99d0_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 709da2bae156b2f569aed96760fc99d0_JaffaCakes118.html
- Size 19KB
- Sample240525-c8aptaca69
- SHA256 4f32c0103d1d56bd0360297f5a70e9a3add8a5311adc37973b63b4d956006f0a
- MD5 709da2bae156b2f569aed96760fc99d0
- SHA1 a4a1f0f857d8e4cc3c799d37dfa57dc9c0a1f11f
- SHA512 4f4171e65ff44ea18263a80d5cf971f466d640ffb4973c3c7534240368910398e9d079a87ce6df56ed315ac1fc67ae85b61f3d678a5a012f7f31da65c5eea375
- SSDEEP 384:SIMd0I5nO9HxNBRvdHX/ZTahIFsvrJDwxDB8:SEjNBRvdHX/ZTahIFOlwA
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2408 msedge.exe 2408 msedge.exe 2248 msedge.exe 2248 msedge.exe 4384 msedge.exe 4384 msedge.exe 4384 msedge.exe 4384 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2248 msedge.exe 2248 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2248 wrote to memory of 5044 2248 msedge.exe 86 PID 2248 wrote to memory of 5044 2248 msedge.exe 86 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 4560 2248 msedge.exe 87 PID 2248 wrote to memory of 2408 2248 msedge.exe 88 PID 2248 wrote to memory of 2408 2248 msedge.exe 88 PID 2248 wrote to memory of 1576 2248 msedge.exe 89 PID 2248 wrote to memory of 1576 2248 msedge.exe 89 PID 2248 wrote to memory of 1576 2248 msedge.exe 89 PID 2248 wrote to memory of 1576 2248 msedge.exe 89 PID 2248 wrote to memory of 1576 2248 msedge.exe 89 PID 2248 wrote to memory of 1576 2248 msedge.exe 89 PID 2248 wrote to memory of 1576 2248 msedge.exe 89 PID 2248 wrote to memory of 1576 2248 msedge.exe 89 PID 2248 wrote to memory of 1576 2248 msedge.exe 89 PID 2248 wrote to memory of 1576 2248 msedge.exe 89 PID 2248 wrote to memory of 1576 2248 msedge.exe 89 PID 2248 wrote to memory of 1576 2248 msedge.exe 89 PID 2248 wrote to memory of 1576 2248 msedge.exe 89 PID 2248 wrote to memory of 1576 2248 msedge.exe 89 PID 2248 wrote to memory of 1576 2248 msedge.exe 89 PID 2248 wrote to memory of 1576 2248 msedge.exe 89 PID 2248 wrote to memory of 1576 2248 msedge.exe 89 PID 2248 wrote to memory of 1576 2248 msedge.exe 89 PID 2248 wrote to memory of 1576 2248 msedge.exe 89 PID 2248 wrote to memory of 1576 2248 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\709da2bae156b2f569aed96760fc99d0_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f44046f8,0x7ff8f4404708,0x7ff8f44047182⤵PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,10005741918567636274,3999275627005926621,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:4560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,10005741918567636274,3999275627005926621,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,10005741918567636274,3999275627005926621,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:82⤵PID:1576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10005741918567636274,3999275627005926621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:4740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10005741918567636274,3999275627005926621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:3676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,10005741918567636274,3999275627005926621,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4912 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4384
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4460
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
- MD5 a8e767fd33edd97d306efb6905f93252
- SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
- SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
- MD5 439b5e04ca18c7fb02cf406e6eb24167
- SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
- SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 fdb5c409a072b10d15da7db1ec87c348ffce3654812b91f014da136defcfc8ad
- MD5 13c0f2ac405959922d5fb2390c9084fc
- SHA1 342b118d8c1b83c99eccd26a3f9ba093efeecf6e
- SHA512 06ee27849a42d29f110e93cc1514da10193c5292b0132dd0e4f899ddfaf5d7a5bb03b107572a855d37336d67257af78c524ea09f67c67bf707eb9c921fc6d37b
- SSDEEP 96:nlkv918BwpvWMoiVmdeHBrzbUWQyV+VDCAiEwb:nlkF6BGWMXprV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 9fba35896bd4388fba2609072fab33347a9319d66ecc4b013b8a94fa0c5ff0f2
- MD5 a4c5b32c6ad06faab9d374eda06acfea
- SHA1 7cdb82ed0e481a67b9af573c53415de70f78c15b
- SHA512 1c1205197b94e000828f640c6abd9e2fd7c0b37fdb9dec9082375a9618c09e46f7ed2907935eee08c20e1e82287151758094bb362846aa2bbda9da1e4dca6560
- SSDEEP 96:nlkk918BwpvWMoiVmdeHBrzbUWQyV+VDCziEwb:nlkg6BGWMXpro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 285e4f033c35c2d9aa2414ce6cbfb63312b502e6e44ed76253f3ad1d99348b01
- MD5 3d752e57e29274225298626981868ef8
- SHA1 67838bbbe6531bd93d3c9cc6fe6da677272715c1
- SHA512 6173a4238c286840187f09adbb6d9470a680f67a8e240ed18579da4e20d9a3ffe727b80b12f3d2be0bee6a5ac08791e3a2a6cd3ee9dd68b788148b4ee2065147
- SSDEEP 96:nlkv918MwpvWMoiVmdeHBrzbUWQyV+VDCAiEwb:nlkF6MGWMXprV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 cd289a3e93d250dc5472492c7856881edc0cac49d6fb9066470e6f08f49d0df3
- MD5 05da681a02acc798a4999d78a7b33259
- SHA1 bf48dc48299d10b4616ef4e5ede5e1881dcdc56d
- SHA512 6cf47e99f6d8d2d8113b17d79081002330a17ed3248865bdecdd59d9cfd63a3c58f0c2f05b95b76485b6879effaebe4f7d0cdb142420404f3479655ad2da39e8
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuptHEe2RUhMC2K3z2OMDCRHI:A9iIxuERzA83h09RZxYtHq/dKaOMWRHI
- MD5 SHA1 SHA512 SSDEEP