Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 12:08
Static task
static1
Behavioral task
behavioral1
Sample
80aebf79d5fb3dd3fd2c42904fd95914_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
80aebf79d5fb3dd3fd2c42904fd95914_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 80aebf79d5fb3dd3fd2c42904fd95914_JaffaCakes118.html
- Size 8KB
- Sample240529-paz82aee37
- SHA256 cca66333a4b4447c11e0dca11d3a572cd893570892ef017c077f2aef93139b30
- MD5 80aebf79d5fb3dd3fd2c42904fd95914
- SHA1 361c5cd787b4b7677758fdffb72ebf10855170ea
- SHA512 e21c91275cd541c31f19e0d279baaac5be433bed4f5e12308322c17df4722d8de5104ea051a860a731efcd36d43d63362d9ceecf98df34315903b6457df84103
- SSDEEP 96:SIAsnbCRvhsnbCLRHsnbCN483O2Usfi8aHuxtJ3OBJUGgwXdap4:SIAs6vhsqVsoN3O2Usfi8uu/wlgadap4
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1960 msedge.exe 1960 msedge.exe 4508 msedge.exe 4508 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4508 msedge.exe 4508 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4508 wrote to memory of 1888 4508 msedge.exe 82 PID 4508 wrote to memory of 1888 4508 msedge.exe 82 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 4516 4508 msedge.exe 83 PID 4508 wrote to memory of 1960 4508 msedge.exe 84 PID 4508 wrote to memory of 1960 4508 msedge.exe 84 PID 4508 wrote to memory of 2936 4508 msedge.exe 85 PID 4508 wrote to memory of 2936 4508 msedge.exe 85 PID 4508 wrote to memory of 2936 4508 msedge.exe 85 PID 4508 wrote to memory of 2936 4508 msedge.exe 85 PID 4508 wrote to memory of 2936 4508 msedge.exe 85 PID 4508 wrote to memory of 2936 4508 msedge.exe 85 PID 4508 wrote to memory of 2936 4508 msedge.exe 85 PID 4508 wrote to memory of 2936 4508 msedge.exe 85 PID 4508 wrote to memory of 2936 4508 msedge.exe 85 PID 4508 wrote to memory of 2936 4508 msedge.exe 85 PID 4508 wrote to memory of 2936 4508 msedge.exe 85 PID 4508 wrote to memory of 2936 4508 msedge.exe 85 PID 4508 wrote to memory of 2936 4508 msedge.exe 85 PID 4508 wrote to memory of 2936 4508 msedge.exe 85 PID 4508 wrote to memory of 2936 4508 msedge.exe 85 PID 4508 wrote to memory of 2936 4508 msedge.exe 85 PID 4508 wrote to memory of 2936 4508 msedge.exe 85 PID 4508 wrote to memory of 2936 4508 msedge.exe 85 PID 4508 wrote to memory of 2936 4508 msedge.exe 85 PID 4508 wrote to memory of 2936 4508 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\80aebf79d5fb3dd3fd2c42904fd95914_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a1dd46f8,0x7ff9a1dd4708,0x7ff9a1dd47182⤵PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17188933192012811216,5952771898613944649,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:4516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,17188933192012811216,5952771898613944649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,17188933192012811216,5952771898613944649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵PID:2936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17188933192012811216,5952771898613944649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:4864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17188933192012811216,5952771898613944649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17188933192012811216,5952771898613944649,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4724 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4648
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4600
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3212
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
- MD5 537815e7cc5c694912ac0308147852e4
- SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
- SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
- MD5 8b167567021ccb1a9fdf073fa9112ef0
- SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
- SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 9cfbee38752ed44c47f705c9643bbde9430424b0945f82c43c2e08af73606489
- MD5 8c23f870594478d993072d1b124fd4ff
- SHA1 e41df1737621b3bb2fba73ce48ba257cda1210c4
- SHA512 1fa61ddf31cb9ed52b6855b4b0711fcb7d7b62d21b33be6f92f06788ec49c39d1a916e5ce47ebf0decf7e2b0f8eff71b74313150c3f7faa80dd311a273708102
- SSDEEP 96:nGkE41uC9wpvWMoiVmdeHpR5l01UWQyV+VDCAiEwb:nGktUC9GWMXp901rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 2909ee1070c6a9cec083ed2ec27d2553bd2a28a4626fc73d9503681c9f102409
- MD5 3894fc47acf3fddbc52e6f025c875ba6
- SHA1 53cc23dcb5dc7ba57d1a00c926a9be15e32642b3
- SHA512 034f097f59579bfbb7e8b317676554eebf81d1ae8e45c68ae72083733f5e12543cfea42cf0598bb0aea892fb8eff9be2ef003663e798a775ba67850fb282bfac
- SSDEEP 96:nGk541uD9wpvWMoiVmdeHpRQl01UWQyV+VDCziEwb:nGk2UD9GWMXpw01ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 5e25182496eff50104414a8f098b954305840427c779fe6e91feb97b28079ce3
- MD5 7b82a3025917d4d4566850de29ffade9
- SHA1 8a14a2f222dc34d8cd8b1c5bdd69c4816610977f
- SHA512 1817d0c497eabd26e44a333967144c963c1ac7d9b7eabf0f89af31e91c7adf1ce3a4fb1ef8f53b3bd865b9ebcf40706206f2c768588da42e97cf251e5984d8cd
- SSDEEP 96:nGkE41uD9wpvWMoiVmdeHpRQl01UWQyV+VDCAiEwb:nGktUD9GWMXpw01rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 77b0b5d4580954f0935ba77bbbc1b33328f208996864d891de3008a686fb89d0
- MD5 a8d9a779bb7acb8311e81fca24d6c3ec
- SHA1 648d257e88439e6e437f8e7a2762b0c56feeb04a
- SHA512 c473cc67209abecf8cd9c35592336134ac3483c8519e533dd4cfb640bf3968e337eebce419197032b64e0c6ce78be95ecdf775a8e097ee501849e75a73aa5009
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupTBe2RUIqTu3z2OMDCRHqlt:A9iIxuERzA83h09RZxYTVuuaOMWRHqlt
- MD5 SHA1 SHA512 SSDEEP