Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
26/05/2024, 05:20
Static task
static1
Behavioral task
behavioral1
Sample
74716a9450ae89e34b4791323f7d1c03_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
74716a9450ae89e34b4791323f7d1c03_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 74716a9450ae89e34b4791323f7d1c03_JaffaCakes118.html
- Size 261KB
- Sample240526-f1vlsshb72
- SHA256 933ca344f7af935cf33486b1d4a88b7f17cdcbde9dfcdd58346c39c766a468fa
- MD5 74716a9450ae89e34b4791323f7d1c03
- SHA1 313ad6026d39016422ede6eca217504ef860ad6a
- SHA512 c9bb64d7aa11b038cc9b4f18310630a9bee5fee6694b5ca2606982475fc6d85b99ffcd8bbb2c18409f982aee5504a3c26ebb298ffe04e8906e6650650f51bd31
- SSDEEP 3072:6FzALz9K/AZkS9Ga/EYk9j/jagazxhic9M2ec71rdBq6gbqz5FN5T+vV8VhPm/iw:ezALz9fl9GdPaga9hNNgcN5G
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3928 msedge.exe 3928 msedge.exe 4088 msedge.exe 4088 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4088 wrote to memory of 3592 4088 msedge.exe 83 PID 4088 wrote to memory of 3592 4088 msedge.exe 83 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3220 4088 msedge.exe 84 PID 4088 wrote to memory of 3928 4088 msedge.exe 85 PID 4088 wrote to memory of 3928 4088 msedge.exe 85 PID 4088 wrote to memory of 3716 4088 msedge.exe 86 PID 4088 wrote to memory of 3716 4088 msedge.exe 86 PID 4088 wrote to memory of 3716 4088 msedge.exe 86 PID 4088 wrote to memory of 3716 4088 msedge.exe 86 PID 4088 wrote to memory of 3716 4088 msedge.exe 86 PID 4088 wrote to memory of 3716 4088 msedge.exe 86 PID 4088 wrote to memory of 3716 4088 msedge.exe 86 PID 4088 wrote to memory of 3716 4088 msedge.exe 86 PID 4088 wrote to memory of 3716 4088 msedge.exe 86 PID 4088 wrote to memory of 3716 4088 msedge.exe 86 PID 4088 wrote to memory of 3716 4088 msedge.exe 86 PID 4088 wrote to memory of 3716 4088 msedge.exe 86 PID 4088 wrote to memory of 3716 4088 msedge.exe 86 PID 4088 wrote to memory of 3716 4088 msedge.exe 86 PID 4088 wrote to memory of 3716 4088 msedge.exe 86 PID 4088 wrote to memory of 3716 4088 msedge.exe 86 PID 4088 wrote to memory of 3716 4088 msedge.exe 86 PID 4088 wrote to memory of 3716 4088 msedge.exe 86 PID 4088 wrote to memory of 3716 4088 msedge.exe 86 PID 4088 wrote to memory of 3716 4088 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\74716a9450ae89e34b4791323f7d1c03_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb649446f8,0x7ffb64944708,0x7ffb649447182⤵PID:3592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,4148083146169922009,11888362938633540502,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:3220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,4148083146169922009,11888362938633540502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,4148083146169922009,11888362938633540502,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:82⤵PID:3716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4148083146169922009,11888362938633540502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:3812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4148083146169922009,11888362938633540502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:2412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,4148083146169922009,11888362938633540502,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4744 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4148083146169922009,11888362938633540502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:12⤵PID:4740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4148083146169922009,11888362938633540502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:12⤵PID:2720
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4988
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4148
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
- MD5 ce4c898f8fc7601e2fbc252fdadb5115
- SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
- SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
- MD5 4158365912175436289496136e7912c2
- SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
- SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4091b8bc-36a7-4799-a020-b6eadccf5bad.tmp
- Size 2KB
- SHA256 b117e3c4a7ffd5bbf42ac095c78c34208baf9b8629a7e1f2b2c798ff06210027
- MD5 be5e85179650963c5ae24d689e69f280
- SHA1 3bd67e45622f78fdc89f1146d185b30c658703f8
- SHA512 949586879eeced9a420e3035093e01222209564ea8e9cc97bb6380db8b0dae38bfb66d775ec9b12dc5f285784b0af86246a84e62e73a5caf2fd08470893d50b4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 cf57ce43260f6ffe6082c866af3bcb2ef6ba156c660a832196f3f038950f458d
- MD5 8ebacdf8ebbff4e74385f9f1a7c3cdb6
- SHA1 dbdc8b688a13fc5b20cca62314b9688ba33e2e39
- SHA512 8cf687e29d54d79913e79ea4afb69531defc605c8aed0aec3c69b4bb031a11fc52d3cddeb8721c37b772b310c61ab5e57b1cb95d8841fac670d3d73eac590b2c
- SSDEEP 96:nBkiE1CgjuwpvWMoiVmdeHvSS7gUWQyV+VDCziEwb:nBkzYgjuGWMXKro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 24f2191d35b8e4730a6209f0738bde1194747cb3ead1464e906020e262028fbf
- MD5 633f7362e779940dab4e4b5f6da07d2b
- SHA1 ca1107cdf89f39078f1831258da9029ac9523e99
- SHA512 7311d29c7386c19a07d1ad1113fc3c508d80487e9f2c4a6bf0d44b85f98132bdac8e8bbf194772b923bfe4f8132cbcdbed4e9368a2e5c3150048d028740e6714
- SSDEEP 96:nBkZE1CgjuwpvWMoiVmdeuZPRE69Ibpw2vSS7gUWQyV+VDCAiEwb:nBk+YgjuGWMeZPREqkpw2KrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
- Size 706B
- SHA256 71c30ab40970e86de2b351374da9ad72490d53aa61604d8c6523a051b6777012
- MD5 6bfac6b203df1852dfde83bb10f3aa3c
- SHA1 c49334e48ef68e5d8593aa4314bbfbd61eeb4d5d
- SHA512 eb6153bd98f916bbc6f0d7151cf3608f9287b40acb0594348eda2cd6a803b37e3e31f6d7a7f04b5f14385c8233572a9396832b634d643b9b17938c1dd06af53b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe598255.TMP
- Size 372B
- SHA256 d659bc92737fc413d3b87af95f59212ffc5bfdb4256e4917ef872a4390816b94
- MD5 46d5762f175c121b9f454ef173148a14
- SHA1 72115c6c9f9384231c4c3044af560150563c615f
- SHA512 2905b9ff7de276e5d4dfafddf00091c023bae71993a488e0290730b5fe0f1c16985610761c3b31a2c0b7ccb3dbf2085dc6ab62a6eb8d30546c8359c481f6b563
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 d36a5b7a8fab1f15d05c952912f616c409acda82d1d02fdaebb0cf2c2f916955
- MD5 e2e74c60f699eaccadfdbe5db6452a2a
- SHA1 84cd5c2bbb5d5c75fe71fe11a39c646b67e7731e
- SHA512 7486660d6d34dc971c45d638a01d988971943db197f6ea424dd63da3b3b77424edb13c2c96d73bf21e03920f063a90e2a559825f76879c939c76479a9038aefa
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupgmke2RU+4uZ3z2OMDCRHqW:A9iIxuERzA83h09RZxY7KfZaOMWRHqlw
- MD5 SHA1 SHA512 SSDEEP