Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
27/05/2024, 11:44
Static task
static1
Behavioral task
behavioral1
Sample
790a4d91705a5c7dffe9d52caa16dbe5_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
790a4d91705a5c7dffe9d52caa16dbe5_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 790a4d91705a5c7dffe9d52caa16dbe5_JaffaCakes118.html
- Size 478KB
- Sample240527-nv7yyabb37
- SHA256 17e53375189562feb15a63776e40dfaa6589404ce73d8a7947885ce96393adb8
- MD5 790a4d91705a5c7dffe9d52caa16dbe5
- SHA1 6528b5e648e691e0d898a5fa5a85fb6004a9d0ba
- SHA512 d6bd0942671ea6cf4e0800ca82d8a4b56acea525924e36d1f4d8edd8c19064df179116c1e3bd8d3864956c9422978fbbcadada74e7a12736ef61ab067e5b9be6
- SSDEEP 6144:SsUfsMYod+X3oI+Y6tvu6xAmzM86P5sZpMFzBtug4r1GcFBU/b:u5d+X3poCPuzmrugwG2qz
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 512 msedge.exe 512 msedge.exe 1072 msedge.exe 1072 msedge.exe 4676 msedge.exe 4676 msedge.exe 4676 msedge.exe 4676 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1072 msedge.exe 1072 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1072 wrote to memory of 4696 1072 msedge.exe 83 PID 1072 wrote to memory of 4696 1072 msedge.exe 83 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 2304 1072 msedge.exe 84 PID 1072 wrote to memory of 512 1072 msedge.exe 85 PID 1072 wrote to memory of 512 1072 msedge.exe 85 PID 1072 wrote to memory of 4188 1072 msedge.exe 86 PID 1072 wrote to memory of 4188 1072 msedge.exe 86 PID 1072 wrote to memory of 4188 1072 msedge.exe 86 PID 1072 wrote to memory of 4188 1072 msedge.exe 86 PID 1072 wrote to memory of 4188 1072 msedge.exe 86 PID 1072 wrote to memory of 4188 1072 msedge.exe 86 PID 1072 wrote to memory of 4188 1072 msedge.exe 86 PID 1072 wrote to memory of 4188 1072 msedge.exe 86 PID 1072 wrote to memory of 4188 1072 msedge.exe 86 PID 1072 wrote to memory of 4188 1072 msedge.exe 86 PID 1072 wrote to memory of 4188 1072 msedge.exe 86 PID 1072 wrote to memory of 4188 1072 msedge.exe 86 PID 1072 wrote to memory of 4188 1072 msedge.exe 86 PID 1072 wrote to memory of 4188 1072 msedge.exe 86 PID 1072 wrote to memory of 4188 1072 msedge.exe 86 PID 1072 wrote to memory of 4188 1072 msedge.exe 86 PID 1072 wrote to memory of 4188 1072 msedge.exe 86 PID 1072 wrote to memory of 4188 1072 msedge.exe 86 PID 1072 wrote to memory of 4188 1072 msedge.exe 86 PID 1072 wrote to memory of 4188 1072 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\790a4d91705a5c7dffe9d52caa16dbe5_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6b7d46f8,0x7ffd6b7d4708,0x7ffd6b7d47182⤵PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,9139562347095506682,5768356600378050185,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:2304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,9139562347095506682,5768356600378050185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,9139562347095506682,5768356600378050185,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:82⤵PID:4188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,9139562347095506682,5768356600378050185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:3140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,9139562347095506682,5768356600378050185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:12⤵PID:3892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,9139562347095506682,5768356600378050185,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4676
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3100
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
- MD5 56641592f6e69f5f5fb06f2319384490
- SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
- SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
- MD5 612a6c4247ef652299b376221c984213
- SHA1 d306f3b16bde39708aa862aee372345feb559750
- SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 8e17e38cbe5f5fc8d96c12aab6f5c0bb45297eb0df74d5bbdc2d4e9c8640040e
- MD5 03fb153255c437cb189bc96d426f34e2
- SHA1 288762383946a73a99c1c74157b3be4337e3849e
- SHA512 9341875b9a82ddaf172f25ab35b6d4e2def87fb8dce70f88235e39d4b2278e5b87abb4e4abb1b3a454d8132d49f279d30ce791484d86e4550bd4fa3bbe50c93b
- SSDEEP 96:nKkit1wAn2wpvWMoiVmdeHk4rUWQyV+VDCziEwb:nKkSaAn2GWMXpro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 ba4dd16342da10d8605c8b34d00ca083e632b01efdc53a9b8c4b134a49fbe4b0
- MD5 bf144cde727682995164e700af5efa6e
- SHA1 54c125e07b8e56c22444f686c30286c1d3acb755
- SHA512 0bb6476a926c59e8935a0405ce2cbab7075964ce5c728d20783e2c5394d7558dc1c684734409db30565e6b7a6b5dc0cc7be1273a363147e41bd66c5243e54332
- SSDEEP 96:nKkZt1wAm2wpvWMoiVmdeHk4rUWQyV+VDCAiEwb:nKkHaAm2GWMXprV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 40bfa2c36940e3140c8beeaffd723058990bacf96885f14590332eca4334ad0c
- MD5 da723c1dfb07b1fd7867276ebeba2c6d
- SHA1 b69fdd7cac5ea791de3ec2f44e8c2e2bd4e3bb4b
- SHA512 863ab3ab570421ad0635d5c8a2d82078d2e8f9a51640f8aa26e149783a16ef764456081232a17f2533027dad71e0306f25f4010d8ef3fe3c3dc25fe749460b52
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup47e2RUi/y4Vz3z2OMDCRHz:A9iIxuERzA83h09RZxY6L5zaOMWRHqlu
- MD5 SHA1 SHA512 SSDEEP