Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 10:32
Static task
static1
Behavioral task
behavioral1
Sample
807055a5690d35d1661882e396c6326d_JaffaCakes118.html
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
807055a5690d35d1661882e396c6326d_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 807055a5690d35d1661882e396c6326d_JaffaCakes118.html
- Size 213KB
- Sample240529-mk8baabf4s
- SHA256 e9f827b15eb2fa59443bc0c663b7353fdf579ff00b4982ba8a5a02f90930482c
- MD5 807055a5690d35d1661882e396c6326d
- SHA1 9251de1bd6ed6bba0ef5f6eb5d62f1544032af79
- SHA512 ad5979c087d0cee73159b940a304a7009d492d370b6d1c38d496ba4cb2113dc6634596b741d7866d4b3d4d0735f491d7251e419e5e42cc30740e0c954cff3da9
- SSDEEP 3072:SHCxYbepCuFXyfkMY+BES09JXAnyrZalI+YQ:SH7+VisMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1164 msedge.exe 1164 msedge.exe 2516 msedge.exe 2516 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2516 msedge.exe 2516 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2516 wrote to memory of 4360 2516 msedge.exe 81 PID 2516 wrote to memory of 4360 2516 msedge.exe 81 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 4188 2516 msedge.exe 82 PID 2516 wrote to memory of 1164 2516 msedge.exe 83 PID 2516 wrote to memory of 1164 2516 msedge.exe 83 PID 2516 wrote to memory of 1048 2516 msedge.exe 84 PID 2516 wrote to memory of 1048 2516 msedge.exe 84 PID 2516 wrote to memory of 1048 2516 msedge.exe 84 PID 2516 wrote to memory of 1048 2516 msedge.exe 84 PID 2516 wrote to memory of 1048 2516 msedge.exe 84 PID 2516 wrote to memory of 1048 2516 msedge.exe 84 PID 2516 wrote to memory of 1048 2516 msedge.exe 84 PID 2516 wrote to memory of 1048 2516 msedge.exe 84 PID 2516 wrote to memory of 1048 2516 msedge.exe 84 PID 2516 wrote to memory of 1048 2516 msedge.exe 84 PID 2516 wrote to memory of 1048 2516 msedge.exe 84 PID 2516 wrote to memory of 1048 2516 msedge.exe 84 PID 2516 wrote to memory of 1048 2516 msedge.exe 84 PID 2516 wrote to memory of 1048 2516 msedge.exe 84 PID 2516 wrote to memory of 1048 2516 msedge.exe 84 PID 2516 wrote to memory of 1048 2516 msedge.exe 84 PID 2516 wrote to memory of 1048 2516 msedge.exe 84 PID 2516 wrote to memory of 1048 2516 msedge.exe 84 PID 2516 wrote to memory of 1048 2516 msedge.exe 84 PID 2516 wrote to memory of 1048 2516 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\807055a5690d35d1661882e396c6326d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffe6f8d46f8,0x7ffe6f8d4708,0x7ffe6f8d47182⤵PID:4360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,10968964509361213841,14615009008604781167,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:22⤵PID:4188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,10968964509361213841,14615009008604781167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,10968964509361213841,14615009008604781167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:82⤵PID:1048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10968964509361213841,14615009008604781167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10968964509361213841,14615009008604781167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:5048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,10968964509361213841,14615009008604781167,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1112
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2108
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:8
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
- MD5 1ac52e2503cc26baee4322f02f5b8d9c
- SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
- SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
- MD5 b2a1398f937474c51a48b347387ee36a
- SHA1 922a8567f09e68a04233e84e5919043034635949
- SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 209c39f5605de0db2e678a29b70a344855803e80a753ece66e866498c063b508
- MD5 e1401f793e5552098ddc909e210c4461
- SHA1 85903b181ca1da5f5ea9174e1a12f85b76def60b
- SHA512 2dec329e14d851ed98012ca583125b9e377d0ebbf415653703bc88a14f01e42701cf790cde0fe1a9b543c86da9b877f541b0e1d3d880fff79a1747ee5c5980dc
- SSDEEP 96:nDEkaT6B1ex3ga9IQwpvWMoiVmdeHpCrBbJUWQyV+VDCAiEwb:nYk7BGQaCQGWMXpubJrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 652d63f1d22046e5e96d2477de6ff09a7e3d4c6c88e4a3a1e74d55dbf7f75ca4
- MD5 fb985a5e1f7123baa77c54b5766a8c6e
- SHA1 eb5ca4fec15142a4ad0045e143dc80f882c7601d
- SHA512 da44cf2ef33cb7bdc6a4d8abff0f5775ea5ac9f3b2874ca8385dd6e4dd59b752660786dece5e324cd1f00081dccfc6be891ca2a0435271c2c98e9fdd2faa557b
- SSDEEP 96:nDEkjT6B1exmga9IQwpvWMoiVmdeHpCrBbJUWQyV+VDCziEwb:nYkyBG1aCQGWMXpubJro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 eec631879e7d61bf4bc057e2ef76698d92824be9b662ccbb020ebbf7a1a8d025
- MD5 4946a8802fc5797bf15f2d0949bd22b8
- SHA1 737527619723d52ef900f266e9a8fb44c367ad98
- SHA512 a8abac60c6d25e15585354651606fd33b65ac488e8092d5b0ec0079799e32fec89176298c346f301f39b6e9a2cf3752c5c089b14360832c5470fffecb3a8173b
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupJCkqje2RUNjf7ZE3z2OMDR:A9iIxuERzA83h09RZxYskWIzZEaOMWRQ
- MD5 SHA1 SHA512 SSDEEP