Analysis
- max time kernel
145s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
26/05/2024, 12:20
Static task
static1
Behavioral task
behavioral1
Sample
75756df895b994212cd1c6d4eeaf7c8d_JaffaCakes118.html
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
75756df895b994212cd1c6d4eeaf7c8d_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 75756df895b994212cd1c6d4eeaf7c8d_JaffaCakes118.html
- Size 147KB
- Sample240526-phra4acf42
- SHA256 61b8e1110845a49158f05d10196acb2687e10d09b5edf30e1e994e5c25536363
- MD5 75756df895b994212cd1c6d4eeaf7c8d
- SHA1 357f2b138d929169e6e00c8924b07e85e0f49630
- SHA512 93fcf16fe473798b42df67b234d20b9c75447c93cf4719945f85d5cd12565374f95c025f575786d7df2af7f48d775b857cc3c7969ca1cf30abcbdc49ec73da7e
- SSDEEP 3072:QxxXK29CssN87E/uzyVpbAJ408BRPblkPUqvzh53soc7qAicimSKrdXhHdnlGnWa:cx6MLE/uzyVpbAJ408BRPblkNC7FZimg
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1820 msedge.exe 1820 msedge.exe 2492 msedge.exe 2492 msedge.exe 5016 msedge.exe 5016 msedge.exe 5016 msedge.exe 5016 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2492 msedge.exe 2492 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe 2492 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2492 wrote to memory of 3224 2492 msedge.exe 82 PID 2492 wrote to memory of 3224 2492 msedge.exe 82 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1256 2492 msedge.exe 83 PID 2492 wrote to memory of 1820 2492 msedge.exe 84 PID 2492 wrote to memory of 1820 2492 msedge.exe 84 PID 2492 wrote to memory of 3672 2492 msedge.exe 85 PID 2492 wrote to memory of 3672 2492 msedge.exe 85 PID 2492 wrote to memory of 3672 2492 msedge.exe 85 PID 2492 wrote to memory of 3672 2492 msedge.exe 85 PID 2492 wrote to memory of 3672 2492 msedge.exe 85 PID 2492 wrote to memory of 3672 2492 msedge.exe 85 PID 2492 wrote to memory of 3672 2492 msedge.exe 85 PID 2492 wrote to memory of 3672 2492 msedge.exe 85 PID 2492 wrote to memory of 3672 2492 msedge.exe 85 PID 2492 wrote to memory of 3672 2492 msedge.exe 85 PID 2492 wrote to memory of 3672 2492 msedge.exe 85 PID 2492 wrote to memory of 3672 2492 msedge.exe 85 PID 2492 wrote to memory of 3672 2492 msedge.exe 85 PID 2492 wrote to memory of 3672 2492 msedge.exe 85 PID 2492 wrote to memory of 3672 2492 msedge.exe 85 PID 2492 wrote to memory of 3672 2492 msedge.exe 85 PID 2492 wrote to memory of 3672 2492 msedge.exe 85 PID 2492 wrote to memory of 3672 2492 msedge.exe 85 PID 2492 wrote to memory of 3672 2492 msedge.exe 85 PID 2492 wrote to memory of 3672 2492 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\75756df895b994212cd1c6d4eeaf7c8d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c04046f8,0x7ff8c0404708,0x7ff8c04047182⤵PID:3224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5355261145541584248,1498445400230279813,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:1256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,5355261145541584248,1498445400230279813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,5355261145541584248,1498445400230279813,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:3672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5355261145541584248,1498445400230279813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:3460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5355261145541584248,1498445400230279813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5355261145541584248,1498445400230279813,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4888 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5016
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1768
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
- MD5 a8e767fd33edd97d306efb6905f93252
- SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
- SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
- MD5 439b5e04ca18c7fb02cf406e6eb24167
- SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
- SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 1KB
- SHA256 1a78d0f79524cfc51b30628f4df880aaa9e64204c28793073400cccc3100c606
- MD5 9e4742b51d49b89ea2b43dbdc9de355d
- SHA1 fc1c6090a2c92a5c2991502baecbc438b11d1bec
- SHA512 d55b903aba70264063ef87d65f271578a696acd8c31b27ed2611afd6aef11f9811a0c7633793a7e47942facf7bf7dbfea9bfb2f71a343e7643e51912c5cac3d1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 131ed149951a7247c69a72d3f917c6fdbd392115ec2137ce4609d37b5a238f08
- MD5 ce1d1fff33322ae7e16434594c7f25e2
- SHA1 68aeebf25921603a7db677feec338aaa9055707a
- SHA512 eba02339db497b9834e7d9ad1d5f78806ae78f58b997583151027809d52884dc3fdc33bf4791b0441dac47f8ef19402c2771658eac4bd2f77b65b20da7a410c1
- SSDEEP 96:nckuS13lVUJwpvWMoiVmdeHBrz+S+UWQyV+VDCziEwb:nckBjmJGWMXkS+ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 59ea6846e8d391dcc1564aba7bb4a3c8790282545b334a58d0553ef9023f312e
- MD5 1ad4440b546d1db3eff1d49302d22595
- SHA1 cd4bd01e60a4af2983c9537a896a9cdc30f78983
- SHA512 63e000b7a122f896b7fe78783005e2f1bbc79bb576871771bf0359aa42e6e19d71be5181738738bd71e46bdd7cbbf2cfacce84098e5cb52c60142a46a3c97f36
- SSDEEP 96:ncklS13lVUJwpvWMoiVmdeL55JxZ2Brz+S+UWQyV+VDCAiEwb:nckgjmJGWMb55JxZ2kS+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 5125aec0ec398e5bc818d90637d6c8d0782660a9ffd5cb87c6fd2aae08bc3680
- MD5 aa53c76786963144e6c72fc4d9f6b98a
- SHA1 6fd49c606ec4e6fdfd6da761c33fa5c96e40fc33
- SHA512 8cfa0daf8129fe82e361532e1277182ded3de61ccb61a7c5ce411e6cf915a1f4a46d8fad32f10701a11711217627df6c43178aad2a7bff36d1da98b75918a04d
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuprHPe2RUVMj2r3z2OMDCRHf:A9iIxuERzA83h09RZxYrH3nyraOMWRHf
- MD5 SHA1 SHA512 SSDEEP