Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
26/05/2024, 10:42
Static task
static1
Behavioral task
behavioral1
Sample
7537daaddc81dc26da880a76b4053067_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
7537daaddc81dc26da880a76b4053067_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 7537daaddc81dc26da880a76b4053067_JaffaCakes118.html
- Size 214KB
- Sample240526-mr62ssfd61
- SHA256 19a77f813e4b2cc83517f663bdc3c70460bed3c90afa2a4b9910d5021c3fd1f8
- MD5 7537daaddc81dc26da880a76b4053067
- SHA1 5797cfd66cb18f093f2079464f37539b74db00ab
- SHA512 f92ac743b52a9f5e8810342da0bb88923c7c3bee7298bec9ff91d77b841dc03aea177cb55a36e863fb49116358585b27d226fcd9d8f8ddcde9c0ffd33bea64eb
- SSDEEP 3072:ArhB9CyHxX7Be7iAvtLPbAwuBNKifXTJv:Yz9VxLY7iAVLTBQJlv
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2304 msedge.exe 2304 msedge.exe 3540 msedge.exe 3540 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3540 msedge.exe 3540 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3540 wrote to memory of 3200 3540 msedge.exe 84 PID 3540 wrote to memory of 3200 3540 msedge.exe 84 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 4836 3540 msedge.exe 85 PID 3540 wrote to memory of 2304 3540 msedge.exe 86 PID 3540 wrote to memory of 2304 3540 msedge.exe 86 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87 PID 3540 wrote to memory of 4596 3540 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7537daaddc81dc26da880a76b4053067_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc374346f8,0x7ffc37434708,0x7ffc374347182⤵PID:3200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16279178024414880868,17190473065090586872,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:4836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,16279178024414880868,17190473065090586872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,16279178024414880868,17190473065090586872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:82⤵PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16279178024414880868,17190473065090586872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16279178024414880868,17190473065090586872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16279178024414880868,17190473065090586872,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1944 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:884
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1684
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
- MD5 2daa93382bba07cbc40af372d30ec576
- SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
- SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
- MD5 ecdc2754d7d2ae862272153aa9b9ca6e
- SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
- SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 3cb3a7e468847ee3134342436f281a03db69824849261480faf202a0a6028613
- MD5 b318fb1e7f91275598d40e003e0322f5
- SHA1 28dd85b7cc9383b7ab8308a2a9649202a863336a
- SHA512 e1d6fa9adf0941fdb5abfe4454db95c687248d99103b395be11f3bd89a37a5b6ec74b53b5384b78a3a09e0db5ad9f11477a48885a3c49d88cf0fca5480e63c25
- SSDEEP 96:nMkj3KL1mT3wpvWMoiVmdeHplwtlacOFUWQyV+VDCziEwb:nMkjKLMrGWMXpgXGro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 dc92befa88bc34e87904f53b2cf24722c38a707a8c4b67347d69f1b652408233
- MD5 bc557a4f649f815fe9fb55da3ce44202
- SHA1 ba4643bbd633ee558de4240efe742e076602c809
- SHA512 4b5db162a062ee3ce38dfdc3b1f1f296a477f7562461f56af420573dc805a2ff4d75e6f6c7808083af16e4020e187a483281cf8ae2f1468968669ea67ba5d20c
- SSDEEP 96:nMka3KL1my3wpvWMoiVmdeHplwtlacOFUWQyV+VDCAiEwb:nMkyKLMaGWMXpgXGrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 35fd7ed6089677249c73f83104f6510572aeda7c4ec4654e1c5267ab9930926a
- MD5 fd586209f175835f0d7480624daabdf0
- SHA1 2f6aa79219edece395976dae617358b7226f39e0
- SHA512 311f0ebc96199f8f7509f139ba30bc091f2459d29141e35e900dcd7d40bb0fccf147251b4d60e6266591884324b298f58bb0b32486c33f5f73df6ce3da7600ac
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupGEe2RUsL/2Z53z2OMDCRHB:A9iIxuERzA83h09RZxYNDLG5aOMWRHqC
- MD5 SHA1 SHA512 SSDEEP