Analysis
- max time kernel
145s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
27/05/2024, 22:06
Static task
static1
Behavioral task
behavioral1
Sample
7ab3b994bbda664c8cb5df05bafab34a_JaffaCakes118.html
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
7ab3b994bbda664c8cb5df05bafab34a_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 7ab3b994bbda664c8cb5df05bafab34a_JaffaCakes118.html
- Size 21KB
- Sample240527-11ewkach44
- SHA256 dc9796a372d052301e66e40b428263c7ae7f81772d4ea41606f78800d2dc918c
- MD5 7ab3b994bbda664c8cb5df05bafab34a
- SHA1 cd037bb7377bca938df469348e00ce20cb48a9ec
- SHA512 2dfdf2a3e7109d0058d432f3147a8165d7fd4dc02ad2ae5fbaf6d66c2f33953273399d0ecb4cb3572d3f46406198861fc6607fefc637ee4f12ac1a69175cf4f4
- SSDEEP 384:ban2sYhsLimyVUqiSiDfQ3akZT107xIOuXwcw/w9wtyV6yV6yVQAhyV9skkUg+Ql:ban2sYhsLimyVY7DfQFda7GWyV6yV6yl
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 948 msedge.exe 948 msedge.exe 4572 msedge.exe 4572 msedge.exe 3516 msedge.exe 3516 msedge.exe 3516 msedge.exe 3516 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4572 wrote to memory of 2200 4572 msedge.exe 83 PID 4572 wrote to memory of 2200 4572 msedge.exe 83 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 440 4572 msedge.exe 84 PID 4572 wrote to memory of 948 4572 msedge.exe 85 PID 4572 wrote to memory of 948 4572 msedge.exe 85 PID 4572 wrote to memory of 4048 4572 msedge.exe 86 PID 4572 wrote to memory of 4048 4572 msedge.exe 86 PID 4572 wrote to memory of 4048 4572 msedge.exe 86 PID 4572 wrote to memory of 4048 4572 msedge.exe 86 PID 4572 wrote to memory of 4048 4572 msedge.exe 86 PID 4572 wrote to memory of 4048 4572 msedge.exe 86 PID 4572 wrote to memory of 4048 4572 msedge.exe 86 PID 4572 wrote to memory of 4048 4572 msedge.exe 86 PID 4572 wrote to memory of 4048 4572 msedge.exe 86 PID 4572 wrote to memory of 4048 4572 msedge.exe 86 PID 4572 wrote to memory of 4048 4572 msedge.exe 86 PID 4572 wrote to memory of 4048 4572 msedge.exe 86 PID 4572 wrote to memory of 4048 4572 msedge.exe 86 PID 4572 wrote to memory of 4048 4572 msedge.exe 86 PID 4572 wrote to memory of 4048 4572 msedge.exe 86 PID 4572 wrote to memory of 4048 4572 msedge.exe 86 PID 4572 wrote to memory of 4048 4572 msedge.exe 86 PID 4572 wrote to memory of 4048 4572 msedge.exe 86 PID 4572 wrote to memory of 4048 4572 msedge.exe 86 PID 4572 wrote to memory of 4048 4572 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7ab3b994bbda664c8cb5df05bafab34a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80fb846f8,0x7ff80fb84708,0x7ff80fb847182⤵PID:2200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,17564749848004043232,4585173035887206511,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:22⤵PID:440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,17564749848004043232,4585173035887206511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,17564749848004043232,4585173035887206511,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:82⤵PID:4048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,17564749848004043232,4585173035887206511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,17564749848004043232,4585173035887206511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,17564749848004043232,4585173035887206511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:12⤵PID:3724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,17564749848004043232,4585173035887206511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:12⤵PID:2036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,17564749848004043232,4585173035887206511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:12⤵PID:3608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,17564749848004043232,4585173035887206511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:12⤵PID:3088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,17564749848004043232,4585173035887206511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:12⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,17564749848004043232,4585173035887206511,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4896 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3516
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1492
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
- MD5 56641592f6e69f5f5fb06f2319384490
- SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
- SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
- MD5 612a6c4247ef652299b376221c984213
- SHA1 d306f3b16bde39708aa862aee372345feb559750
- SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b
- Size 64KB
- SHA256 fff862b0089589b20e9ec4313d386b67dae4b980bbcb2edda4ffe8b59e879668
- MD5 4ab87b96ff7dabf463bd4c98d76ebe4a
- SHA1 abea9b5840a65f967dd83423936b8c9a99be8f2e
- SHA512 3cec93a725828c4c65245da261a9225a8dc819a0f9bf07fd3c9a27922c9f3d2cd6a06ccb353e1a1dce38b2f4fc4335abb0024f60df4734ba8e677837daf0e36e
- SSDEEP 1536:tSPjXDII+/qeyTXgIq1+iam+2gDzMKo7QCoOB:tSPzDYwUL1+jxlo7QxOB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 792B
- SHA256 99bc8376a0404129d2439a86a5335fc27b6e2e01ae9e14981dcc2d77e9081ccc
- MD5 547c7ba72f95fefab9d5a101db8c4574
- SHA1 575fa62326486b103c501a0a863f226b97901725
- SHA512 fbc2eeaa38e4d0ecec80fca9561a8003d2b124de36c262c3975c5dfd7684de87a3c5caef9cf0808ca3d0ed939bb5737d069e3e6dfb4f0fe65616e75751c34dd6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 2KB
- SHA256 8d08c2297254e80977654f3ccc4b451a6bc5572d7f9bc8a6b5a27df9daa4322f
- MD5 389e50b9ff542c9fe293ccbdc95671d8
- SHA1 f61a195a707c04bbcea089f311b056083cf04175
- SHA512 13ba1cfba608269bfd45572fc3c91e37018fc277fd3b0a2f37847a8c84881b5469e87035a9d3ad8aa0068e2aa4eeeca8ac8fca7299770ec32bf13193606a769d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 8c9f6aac54dd7a4c5c36f438a6dc97f8c0bb42eaf4f610cf39bf2db1bfb983df
- MD5 15303cb63d099a41dbee2fd980ff71e0
- SHA1 9df1e9f5a71068bf68d13500d657f306a65644b9
- SHA512 58fae3b0a999b5b3517182889dc95fad705a70ddc640be0834518c48e0d654c61cb2132850aeb3a28835303490ff9d8f42878de8a7b082fd18481f422cd529cb
- SSDEEP 96:nHkigQ1Gn2wpvWMoiVmdeHk44UWQyV+VDCziEwb:nHkGsn2GWMXWro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 37e4d93ec8e54aa2643b4fb8490a5029be69979b95dd328acbe31ac1eed697b9
- MD5 63d179ff30dc5a90f0e6b1b52416ae89
- SHA1 b750f4ed4948d48e0240711114e2ddb3619f5972
- SHA512 752fa5748edd086cb0262568087b717b72d56db9dbbd8ca0e967fa0871061f12c6a7826f791655b13c6bb5c90e69099c0356d87071d2801c7d7be26ed025ae7e
- SSDEEP 96:nHkZgQ1Gn2wpvWMoiVmdeMeS4YMzd428Gh8qk44UWQyV+VDCAiEwb:nHkrsn2GWMzLF54278qWrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 add763705158c4c03828c8955f93453aa8e70e8f64b3a0b9094703dd0c00cbed
- MD5 5acd155911739e2a4b3b68debafa538c
- SHA1 9769d7ecd1cbf848838fa0b78de758fceb2a16e4
- SHA512 b1199db658f37949305b7895fc3b8b01332a9ab5bf2692c75d909ef5e22526e075a58fc0404271b936cfdaf94eea530c715140706028fe3af0ba263d34e9ddb1
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupgie2RUOy4V23z2OMDCRHqZ:A9iIxuERzA83h09RZxYRN2aOMWRHqlWw
- MD5 SHA1 SHA512 SSDEEP