Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
26/05/2024, 03:06
Static task
static1
Behavioral task
behavioral1
Sample
74254770a8402caa7fd3e102083da287_JaffaCakes118.html
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
74254770a8402caa7fd3e102083da287_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 74254770a8402caa7fd3e102083da287_JaffaCakes118.html
- Size 139KB
- Sample240526-dl8trsdd63
- SHA256 bfdfbb442ccb49c2f3c203df9a7eabbc7554e3a0ea65383c639091a4719c295f
- MD5 74254770a8402caa7fd3e102083da287
- SHA1 a513585e45d340d7c23fcbc58dddb5c7b103e5d7
- SHA512 d9a0f0cafbd75ff21f17b30a694e6641366da960769e8517c4ab611beb15c35fd50b6200dc4d1eff49dcb7ebf10f9fe267bca6547f4f920d61aec151b9c186a6
- SSDEEP 1536:SMT1EO0ZNHslCAyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:SMVYjAyfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3752 msedge.exe 3752 msedge.exe 3628 msedge.exe 3628 msedge.exe 3688 msedge.exe 3688 msedge.exe 3688 msedge.exe 3688 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3628 msedge.exe 3628 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe 3628 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3628 wrote to memory of 3360 3628 msedge.exe 83 PID 3628 wrote to memory of 3360 3628 msedge.exe 83 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 1360 3628 msedge.exe 84 PID 3628 wrote to memory of 3752 3628 msedge.exe 85 PID 3628 wrote to memory of 3752 3628 msedge.exe 85 PID 3628 wrote to memory of 3444 3628 msedge.exe 86 PID 3628 wrote to memory of 3444 3628 msedge.exe 86 PID 3628 wrote to memory of 3444 3628 msedge.exe 86 PID 3628 wrote to memory of 3444 3628 msedge.exe 86 PID 3628 wrote to memory of 3444 3628 msedge.exe 86 PID 3628 wrote to memory of 3444 3628 msedge.exe 86 PID 3628 wrote to memory of 3444 3628 msedge.exe 86 PID 3628 wrote to memory of 3444 3628 msedge.exe 86 PID 3628 wrote to memory of 3444 3628 msedge.exe 86 PID 3628 wrote to memory of 3444 3628 msedge.exe 86 PID 3628 wrote to memory of 3444 3628 msedge.exe 86 PID 3628 wrote to memory of 3444 3628 msedge.exe 86 PID 3628 wrote to memory of 3444 3628 msedge.exe 86 PID 3628 wrote to memory of 3444 3628 msedge.exe 86 PID 3628 wrote to memory of 3444 3628 msedge.exe 86 PID 3628 wrote to memory of 3444 3628 msedge.exe 86 PID 3628 wrote to memory of 3444 3628 msedge.exe 86 PID 3628 wrote to memory of 3444 3628 msedge.exe 86 PID 3628 wrote to memory of 3444 3628 msedge.exe 86 PID 3628 wrote to memory of 3444 3628 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\74254770a8402caa7fd3e102083da287_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8b2046f8,0x7ffe8b204708,0x7ffe8b2047182⤵PID:3360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,5165834337121375277,11996488218766797111,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:1360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,5165834337121375277,11996488218766797111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,5165834337121375277,11996488218766797111,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:82⤵PID:3444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5165834337121375277,11996488218766797111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:1448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5165834337121375277,11996488218766797111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:1080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,5165834337121375277,11996488218766797111,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3024 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3688
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2248
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3320
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
- MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
- SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
- SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
- MD5 87f7abeb82600e1e640b843ad50fe0a1
- SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
- SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 768997fa866b1178c0055a1489af85e3f1328beb6baabb041ba0cfc62f590f6e
- MD5 52729d8d95edc3fbbd87be9fbe98cf8e
- SHA1 44e02ab6b21505bcbb92815afe1df455ea546e8a
- SHA512 5161a3084814189c5318077572c2ab6abe1d562cc65364a4879ac89eefcac1ec387c28e7c6eba2b61d2968f124d7162112cd2178b3463a592a0df6c060b2c611
- SSDEEP 96:nHkZh1pdq0wpvWMoiVmdeH/zLeUWQyV+VDCAiEwb:nHk/HdZGWMXWrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 3271b6feffeeefa501b4ed36b76c4587e0a98d1711e4f60e0dd60fb74a863780
- MD5 37085bd7ddd54eb4aa28ac2313e9fd10
- SHA1 a85bcf7f5909a3c5e3111d85e9ae87abdf9ec383
- SHA512 2a57a2080f7c7ee1315c5adda20e611b7d66775d0479fa7065b3a40a0f9772c37dc00174a1d84d374b72f74ed140a5296aacded47bb97bde7e730ec818db537f
- SSDEEP 96:nHkih1pdT0wpvWMoiVmdeH/zLeUWQyV+VDCziEwb:nHkSHdgGWMXWro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 6c77cf0470579f5a8789b2474d9b0e579ed8f9252e52f712fb2baef0f9ed7510
- MD5 cdde0a223c25c5de90eb123b1c835489
- SHA1 b2b32d46af96cd959d9cfc52ec0463f155165e43
- SHA512 d882ccd849ea99e4a6eec1aa5b8612f6565e1bf38cd907669c6537e7288c6734db49554f19be1666b6cbb9d63e1b41805272354a41e97e2ae2b7ecd8b5064676
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupD/AvGe2RUTPygM3z2OMDCK:A9iIxuERzA83h09RZxYD/uIFgMaOMWRk
- MD5 SHA1 SHA512 SSDEEP