Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 10:24
Static task
static1
Behavioral task
behavioral1
Sample
806b325c225df77716f48f776f9f194b_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
806b325c225df77716f48f776f9f194b_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 806b325c225df77716f48f776f9f194b_JaffaCakes118.html
- Size 349KB
- Sample240529-mfnfbacb68
- SHA256 aaa99e2a0bc9569c20830ba8016cec1043ffe2f4127cc9c93d567d0a5324901d
- MD5 806b325c225df77716f48f776f9f194b
- SHA1 f528972d54fa07b932b515034dd5c32fd7abc723
- SHA512 241094df792356c28203bc493f1974b6f8e0b53437359cae3a41c1d0ba9c2f2ec7637b480abf9ff58d11de3ebbdfad5fc59e2b9760427ec7919debe5d82e287b
- SSDEEP 6144:SzsMYod+X3oI+YyHEsMYod+X3oI+YAsMYod+X3oI+YQ:m5d+X315d+X3Y5d+X3+
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3592 msedge.exe 3592 msedge.exe 4524 msedge.exe 4524 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4524 msedge.exe 4524 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4524 wrote to memory of 888 4524 msedge.exe 83 PID 4524 wrote to memory of 888 4524 msedge.exe 83 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 552 4524 msedge.exe 84 PID 4524 wrote to memory of 3592 4524 msedge.exe 85 PID 4524 wrote to memory of 3592 4524 msedge.exe 85 PID 4524 wrote to memory of 1696 4524 msedge.exe 86 PID 4524 wrote to memory of 1696 4524 msedge.exe 86 PID 4524 wrote to memory of 1696 4524 msedge.exe 86 PID 4524 wrote to memory of 1696 4524 msedge.exe 86 PID 4524 wrote to memory of 1696 4524 msedge.exe 86 PID 4524 wrote to memory of 1696 4524 msedge.exe 86 PID 4524 wrote to memory of 1696 4524 msedge.exe 86 PID 4524 wrote to memory of 1696 4524 msedge.exe 86 PID 4524 wrote to memory of 1696 4524 msedge.exe 86 PID 4524 wrote to memory of 1696 4524 msedge.exe 86 PID 4524 wrote to memory of 1696 4524 msedge.exe 86 PID 4524 wrote to memory of 1696 4524 msedge.exe 86 PID 4524 wrote to memory of 1696 4524 msedge.exe 86 PID 4524 wrote to memory of 1696 4524 msedge.exe 86 PID 4524 wrote to memory of 1696 4524 msedge.exe 86 PID 4524 wrote to memory of 1696 4524 msedge.exe 86 PID 4524 wrote to memory of 1696 4524 msedge.exe 86 PID 4524 wrote to memory of 1696 4524 msedge.exe 86 PID 4524 wrote to memory of 1696 4524 msedge.exe 86 PID 4524 wrote to memory of 1696 4524 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\806b325c225df77716f48f776f9f194b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb7d346f8,0x7ffdb7d34708,0x7ffdb7d347182⤵PID:888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1464,10677925506091735196,4916079511812644027,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:22⤵PID:552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1464,10677925506091735196,4916079511812644027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2572 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1464,10677925506091735196,4916079511812644027,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:82⤵PID:1696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,10677925506091735196,4916079511812644027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:3844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,10677925506091735196,4916079511812644027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1464,10677925506091735196,4916079511812644027,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4460
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5100
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
- MD5 ce4c898f8fc7601e2fbc252fdadb5115
- SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
- SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
- MD5 4158365912175436289496136e7912c2
- SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
- SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 df96448f519f91f4c4d712f5d79ccea3e018bebc65ba222cee9d8dee6b0d8cf9
- MD5 a313714774913b0e150086c410c7bd3f
- SHA1 d46c1b2f4ad769edc05dab6e0ec2de563474ca67
- SHA512 efbad723fbc6f8832af756c49fb5e12d3243b8169d5f76953e8b12379e990993bc555ba8cede3f6b15a9613bd8c80ca534977b04de1b036247019e128baec96d
- SSDEEP 96:n6kE41UJaZjuwpvWMoiVmdeHvSSPNrUWQyV+VDCziEwb:n6kZ6JaZjuGWMXJNrro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 29e71208e806ffa989b9b51bd34ef9e703d403e10bc9552e938fd6e603cd32b7
- MD5 668a1a9fb6229708559e48af1a0792ab
- SHA1 f36bc7c4793e5ced359f85922514c085807c970b
- SHA512 684ced0a85f2c3cf52cc758110ba7ce7324feb78e796c8ae0b3ed5ee2cf505fe5246f61a54756566c25473354e9d01b9d1eed15a977e24d741cbaa39fb6129f0
- SSDEEP 96:n6kP41UJaejuwpvWMoiVmdeHvSSPNrUWQyV+VDCAiEwb:n6kA6JaejuGWMXJNrrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 14a14c9c2ce9b534f9a4699ea385255e99bd635a5d992b6733a00fc6cc289ae0
- MD5 e4c844634fd839362c8183ef8ccf7bc9
- SHA1 289e2c1ec0ebecedfa1684fa76a331a16f15499a
- SHA512 6cba5374486b6efd2a9257de45c7b9eba17e39aba3b6f360cfe8b933e7f106dd9a39e9471ee7e60c42933c07fa33d0001beffb3cce3ebfffc7cb82987e238a71
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupBle2RUxHRuj3z2OMDCRHqA:A9iIxuERzA83h09RZxYBBPjaOMWRHqlq
- MD5 SHA1 SHA512 SSDEEP