Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
80b5d0931622c555893a089d71429077_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
80b5d0931622c555893a089d71429077_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 80b5d0931622c555893a089d71429077_JaffaCakes118.html
- Size 218KB
- Sample240529-pgq9pseg65
- SHA256 e80e98d485f930e06e2fd3a2b95fb67ab38a2ff00f9f214fc3f266a39ea9d3f6
- MD5 80b5d0931622c555893a089d71429077
- SHA1 8f15b50bb6b663f20211c732bc50751de7e99cda
- SHA512 c228cc8f5ae9bfecfbb88adca4578cb209ee6ecccb88d4093359870ca3175687ef04061ac6fed78ef2468a0d2e0d5f1a7643140fc23d44c33d735491b92bb90c
- SSDEEP 3072:SyEgF4yzjVEiUyfkMY+BES09JXAnyrZalI+YQ:SyEgpzZZsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1452 msedge.exe 1452 msedge.exe 3320 msedge.exe 3320 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3320 msedge.exe 3320 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3320 wrote to memory of 3660 3320 msedge.exe 83 PID 3320 wrote to memory of 3660 3320 msedge.exe 83 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1420 3320 msedge.exe 84 PID 3320 wrote to memory of 1452 3320 msedge.exe 85 PID 3320 wrote to memory of 1452 3320 msedge.exe 85 PID 3320 wrote to memory of 2480 3320 msedge.exe 86 PID 3320 wrote to memory of 2480 3320 msedge.exe 86 PID 3320 wrote to memory of 2480 3320 msedge.exe 86 PID 3320 wrote to memory of 2480 3320 msedge.exe 86 PID 3320 wrote to memory of 2480 3320 msedge.exe 86 PID 3320 wrote to memory of 2480 3320 msedge.exe 86 PID 3320 wrote to memory of 2480 3320 msedge.exe 86 PID 3320 wrote to memory of 2480 3320 msedge.exe 86 PID 3320 wrote to memory of 2480 3320 msedge.exe 86 PID 3320 wrote to memory of 2480 3320 msedge.exe 86 PID 3320 wrote to memory of 2480 3320 msedge.exe 86 PID 3320 wrote to memory of 2480 3320 msedge.exe 86 PID 3320 wrote to memory of 2480 3320 msedge.exe 86 PID 3320 wrote to memory of 2480 3320 msedge.exe 86 PID 3320 wrote to memory of 2480 3320 msedge.exe 86 PID 3320 wrote to memory of 2480 3320 msedge.exe 86 PID 3320 wrote to memory of 2480 3320 msedge.exe 86 PID 3320 wrote to memory of 2480 3320 msedge.exe 86 PID 3320 wrote to memory of 2480 3320 msedge.exe 86 PID 3320 wrote to memory of 2480 3320 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\80b5d0931622c555893a089d71429077_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa439e46f8,0x7ffa439e4708,0x7ffa439e47182⤵PID:3660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,6938811392732811435,4105961842334238327,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:1420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,6938811392732811435,4105961842334238327,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2552 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,6938811392732811435,4105961842334238327,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:82⤵PID:2480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6938811392732811435,4105961842334238327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6938811392732811435,4105961842334238327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,6938811392732811435,4105961842334238327,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2764 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3664
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5064
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
- MD5 8b167567021ccb1a9fdf073fa9112ef0
- SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
- SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 111B
- SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
- MD5 807419ca9a4734feaf8d8563a003b048
- SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
- SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 3a0a9363bcb8a403839f78888ddb2b7fa3c885f3feb6babd85753f0c5678ca5c
- MD5 f9db011c3f22d8a69af1a905c7e81c9c
- SHA1 8e1c0698b645e588983b6b6c8cf730104b572add
- SHA512 52b568aff45b174c6a8cb5b3da27a160d35a9c8ec3a2f6fe26063f63cbc906b58f7d411e29b30bc555a3018544259da8d2b9a1d3a09809c3fd609216ea554350
- SSDEEP 96:nGk8j1bi9wpvWMoiVmdeHpRQGM+IUWQyV+VDCAiEwb:nGk2hi9GWMXpnM+IrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 b975033485b93c592a54013afc274ff4ab4eef3314e62a26c4089cb0ee708d5e
- MD5 8b7408221c91fcbf4aabb3235ef30f76
- SHA1 0ceb21adec6310b82259142e89d0f4bccf548018
- SHA512 303f199f0cb63e33b4504028e51966485ba63b7ef8c1b0d39a770aca21c70f6405a5140e64fd1d21fdd7e02cd0b51a6f0ddcaa67c1605ecd0b48619e243a209c
- SSDEEP 96:nGkRj1bj9wpvWMoiVmdeHpRQGM+IUWQyV+VDCziEwb:nGkxhj9GWMXpnM+Iro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 a0d8aa0491f15c31e6d49a7158b6a7f921083d08bc653541a89a66ab3a1b1d0f
- MD5 caa318b4cde8ce73b02213e4fcdc3c35
- SHA1 b0e882b4556ca22c64a72563e143bed32f3d86e5
- SHA512 a66678d6e5bc2c5b294580f1d39015bc023197cd89b51510c8c9617c6bae5329e1402423d831ea8f5f9de0c4570a5c0c581c76ad65f28f5f820ddf3b583dcd0e
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupM8e2RUWzTo3z2OMDCRHqlM:A9iIxuERzA83h09RZxYMi3oaOMWRHqlM
- MD5 SHA1 SHA512 SSDEEP