Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 08:14
Static task
static1
Behavioral task
behavioral1
Sample
80106ec328f898e06dc5e84a6d6f4392_JaffaCakes118.html
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
80106ec328f898e06dc5e84a6d6f4392_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 80106ec328f898e06dc5e84a6d6f4392_JaffaCakes118.html
- Size 139KB
- Sample240529-j5gsaagc2s
- SHA256 f3c702081d434c371e672d8e942b75af34ba717b674daadb3f60392638d07503
- MD5 80106ec328f898e06dc5e84a6d6f4392
- SHA1 a55a2f8a7d1531eb5574d72f11afdf352811b1e9
- SHA512 3926ed625352b2569bfe5464a920baec7006adabe4e69c3ce3519c23aebe58a44e59d5be9449813ad1bd42464409c23cc1f43eb4d9bcbceb96bda9b7d71d79a6
- SSDEEP 3072:S7gLTRSAWP+WyfkMY+BES09JXAnyrZalI+YQ:SMY7wsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2688 msedge.exe 2688 msedge.exe 1628 msedge.exe 1628 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1628 msedge.exe 1628 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe 1628 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1628 wrote to memory of 60 1628 msedge.exe 83 PID 1628 wrote to memory of 60 1628 msedge.exe 83 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 5012 1628 msedge.exe 84 PID 1628 wrote to memory of 2688 1628 msedge.exe 85 PID 1628 wrote to memory of 2688 1628 msedge.exe 85 PID 1628 wrote to memory of 1324 1628 msedge.exe 86 PID 1628 wrote to memory of 1324 1628 msedge.exe 86 PID 1628 wrote to memory of 1324 1628 msedge.exe 86 PID 1628 wrote to memory of 1324 1628 msedge.exe 86 PID 1628 wrote to memory of 1324 1628 msedge.exe 86 PID 1628 wrote to memory of 1324 1628 msedge.exe 86 PID 1628 wrote to memory of 1324 1628 msedge.exe 86 PID 1628 wrote to memory of 1324 1628 msedge.exe 86 PID 1628 wrote to memory of 1324 1628 msedge.exe 86 PID 1628 wrote to memory of 1324 1628 msedge.exe 86 PID 1628 wrote to memory of 1324 1628 msedge.exe 86 PID 1628 wrote to memory of 1324 1628 msedge.exe 86 PID 1628 wrote to memory of 1324 1628 msedge.exe 86 PID 1628 wrote to memory of 1324 1628 msedge.exe 86 PID 1628 wrote to memory of 1324 1628 msedge.exe 86 PID 1628 wrote to memory of 1324 1628 msedge.exe 86 PID 1628 wrote to memory of 1324 1628 msedge.exe 86 PID 1628 wrote to memory of 1324 1628 msedge.exe 86 PID 1628 wrote to memory of 1324 1628 msedge.exe 86 PID 1628 wrote to memory of 1324 1628 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\80106ec328f898e06dc5e84a6d6f4392_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff810c046f8,0x7ff810c04708,0x7ff810c047182⤵PID:60
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,9993280514241212340,2754075223353113921,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:5012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,9993280514241212340,2754075223353113921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,9993280514241212340,2754075223353113921,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:82⤵PID:1324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9993280514241212340,2754075223353113921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9993280514241212340,2754075223353113921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,9993280514241212340,2754075223353113921,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2208
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2172
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
- MD5 a8e767fd33edd97d306efb6905f93252
- SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
- SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
- MD5 439b5e04ca18c7fb02cf406e6eb24167
- SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
- SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 2368903144da757289053b98f00d7493a3f68a497761e6c041a489c24a63cc97
- MD5 7115570973a554ccc52b4144786d385e
- SHA1 66e0f6432940cf06c0439903cb9a71baebdc24e4
- SHA512 0e9b167cf3ff6e50e702b7d65d9774292292958e94315cda8e35242e08f7ac6615d87e22446fce96f1018dfaf05e99e689385ef9985db55f5203668d7e864f6a
- SSDEEP 96:npkkR1qBwpvWMoiVmdeHBrzr+UWQyV+VDCziEwb:npkgABGWMX5+ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 885b2db11d95175c8a184f329afe31692469e2ce073eebba1cadbb566ff88dca
- MD5 0afd1e7fbcb1b69c2b4118e07536acea
- SHA1 1c7dc5beb64a401458a9e8d89564b91fa83bd214
- SHA512 63b8561614df1c6ce4fd87cb1a4fbc9cb1932396e7bc57bd8cb93fd70d768dd92cfb4a7c867479617a3b6498b3b03b146b1966653471433de46aeb99b4aff324
- SSDEEP 96:npkvR1qMwpvWMoiVmdeHBrzr+UWQyV+VDCAiEwb:npkpAMGWMX5+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 87eb9b519731e2bc8ee15a2d86df902135a4a1d4fc2413be6304558a2370fd95
- MD5 8bd4e124488b92f40ee26323fff5e59c
- SHA1 e1e4ed1be413a06b106f9e9ea9564e836d52193a
- SHA512 cd3c0a2154931ba9fb818b5b47f6e44a97ef08ffc3b98404d0931229cfe0285773849986bdd8ec136df55fa81861161d5f36e54109e771ac4f13ec1b7d8a2c3f
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupiH5e2RUPMC2f3z2OMDCRHF:A9iIxuERzA83h09RZxYiHt9dfaOMWRHF
- MD5 SHA1 SHA512 SSDEEP