Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 15:01
Static task
static1
Behavioral task
behavioral1
Sample
812358fc62d72a8ceabc656b9133a681_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
812358fc62d72a8ceabc656b9133a681_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 812358fc62d72a8ceabc656b9133a681_JaffaCakes118.html
- Size 193KB
- Sample240529-sdw8bsaf77
- SHA256 cd87ec79c67872bea152d816661c64f6d29182d48c1fa45483297624c6e710a9
- MD5 812358fc62d72a8ceabc656b9133a681
- SHA1 83747b1382865eb52480527372d04d871bb9db92
- SHA512 8c384e26dc96fdbc71f0e400bc2eb4b57e50b453e1320a02590908a72f833c96f06bfe08f0cc8e166329d761b3773e0d81f3bc6881432be00b5c872933963109
- SSDEEP 3072:pb7lasA8RdOQJBzAcajCWvzowcXmNRSUrLAK7WgAjRvzWWLTaA1jMgNFRIKMt9x:pbi8RdOQJBAcajfqXmNRfua
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3880 msedge.exe 3880 msedge.exe 3532 msedge.exe 3532 msedge.exe 532 msedge.exe 532 msedge.exe 532 msedge.exe 532 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe 3532 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3532 wrote to memory of 2184 3532 msedge.exe 82 PID 3532 wrote to memory of 2184 3532 msedge.exe 82 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3056 3532 msedge.exe 83 PID 3532 wrote to memory of 3880 3532 msedge.exe 84 PID 3532 wrote to memory of 3880 3532 msedge.exe 84 PID 3532 wrote to memory of 2356 3532 msedge.exe 85 PID 3532 wrote to memory of 2356 3532 msedge.exe 85 PID 3532 wrote to memory of 2356 3532 msedge.exe 85 PID 3532 wrote to memory of 2356 3532 msedge.exe 85 PID 3532 wrote to memory of 2356 3532 msedge.exe 85 PID 3532 wrote to memory of 2356 3532 msedge.exe 85 PID 3532 wrote to memory of 2356 3532 msedge.exe 85 PID 3532 wrote to memory of 2356 3532 msedge.exe 85 PID 3532 wrote to memory of 2356 3532 msedge.exe 85 PID 3532 wrote to memory of 2356 3532 msedge.exe 85 PID 3532 wrote to memory of 2356 3532 msedge.exe 85 PID 3532 wrote to memory of 2356 3532 msedge.exe 85 PID 3532 wrote to memory of 2356 3532 msedge.exe 85 PID 3532 wrote to memory of 2356 3532 msedge.exe 85 PID 3532 wrote to memory of 2356 3532 msedge.exe 85 PID 3532 wrote to memory of 2356 3532 msedge.exe 85 PID 3532 wrote to memory of 2356 3532 msedge.exe 85 PID 3532 wrote to memory of 2356 3532 msedge.exe 85 PID 3532 wrote to memory of 2356 3532 msedge.exe 85 PID 3532 wrote to memory of 2356 3532 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\812358fc62d72a8ceabc656b9133a681_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff54f946f8,0x7fff54f94708,0x7fff54f947182⤵PID:2184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,12232642722313591554,17322225693262921837,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:22⤵PID:3056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,12232642722313591554,17322225693262921837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,12232642722313591554,17322225693262921837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵PID:2356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,12232642722313591554,17322225693262921837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:4764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,12232642722313591554,17322225693262921837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,12232642722313591554,17322225693262921837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:1520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,12232642722313591554,17322225693262921837,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2716 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:532
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1924
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
- MD5 2daa93382bba07cbc40af372d30ec576
- SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
- SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
- MD5 ecdc2754d7d2ae862272153aa9b9ca6e
- SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
- SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
- Size 22KB
- SHA256 bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105
- MD5 5e74c6d871232d6fe5d88711ece1408b
- SHA1 1a5d3ac31e833df4c091f14c94a2ecd1c6294875
- SHA512 9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5
- SSDEEP 384:z5y45znEXC0Kl3/5Lw9MeUrFLMuNrn9GVxEVSYnBvTzlmylDY99v2VQYfoorMEiJ:zznaC0S3xL3KmGLYSKTzlJY99OVQYwAK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 144B
- SHA256 ef5e7168b546c082441f69182ac3dacf2cc14646aecde509adb922086eb1817c
- MD5 7e65ba4ff63655fa3eb210db3362635b
- SHA1 e0971b80867b624055783fae29c14d5153af8fb1
- SHA512 1c41b6d99ab0d84f774edaf3a302b8c9f5537c3b5905ac9d2e3f89572ab08219de505722a698716eb40e37ed270eeb87449c6de785c4094645c12296060886a3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 120B
- SHA256 7ece96c8e75c323dec94d652b22f307cd83f91cefe8e723d1a0da7b0534d46b1
- MD5 3a74e850ce3c2ac519045cf69c7d0213
- SHA1 7536ca117a127ea9a32557f6ed4061f5abd3b473
- SHA512 5d595b8b69bdc48dbe1e3608b55e630fe82e61b040b940d80dacf8fa35340b08a28dca49b7963f993e6b70c526b0721012b06538e2b21ee978bcc48fd055509b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 2KB
- SHA256 9f971cdc07133a8a3c0f4f175c6dd7ceb7c04c08136429449e963e8c8818dbf3
- MD5 a0693ef8691895ccd11cc91a46fbe6c4
- SHA1 7f33c1566dc21538ba7ed0403e712e4e84a03b19
- SHA512 1a9ec61eb9fc70cd87947ce6c9c469a297dfe2767f0033673dec1676cca0fa614225e0c645e04c53f84783d9bc59c89cef328ee9648ab0b5feb9bf8f7fe7541e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 c3189e37384785cb259008102e21a523d56ec1f8f304ec26718b48396c8c74d8
- MD5 41743ba8fe04383919333e98a9d11fb5
- SHA1 cbe91a7f73b60e14ab2cc9115557adbef3cbdf60
- SHA512 21f76aa19b7e8b42472387e29a28de7107a175d12ab7ce94bffa6571fa49bffa10a77c043fa7891c1d208baaa5616f6ced216a22d70d0ea703b14f456d0456e0
- SSDEEP 96:nsk5pm1673wpvWMoiVmdeHplwtLacyUWQyV+VDCziEwb:nskLm0jGWMXpqXyro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 d2351957e2a24a47c4f38651352cea5e2d6142ec739217ccb64e446e30bcf668
- MD5 2e7cdedc89966ee3d706f26ad4a050c0
- SHA1 3b4e4852da5df1f29c4436e9e77c23bcab351e56
- SHA512 e04697f55a655f6e5859e3570b258760ce3ec1f349296876c5b238e66b096238a8329c2fbb9313bc7c0ed5c2f029a8a9f804a4e2d097eb0074b3556c1756d371
- SSDEEP 96:nskEpm1673wpvWMoiVmdeXgVbSs+ZUW2plwtLacyUWQyV+VDCAiEwb:nskIm0jGWMnglSs+ZUW2pqXyrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 a50c7f08a64dc0d78be51048126823e2b9b8a291373fc5544157943af071820c
- MD5 39c5faaf8a1d4f2f0d0935725fb5eb24
- SHA1 94d0187bb45ddfc4ab995f0bad7eda7b96150663
- SHA512 160b6fa1f69cc0efb3aa4c7153e4a36bb3e368ed13d410c6b6699c4bc9d6c7c37a26c7998baccea974908c38d4c2eab9f393abd6ab3351b0f18e0c52c6583106
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupkDde2RUQ82Z6l3z2OMDCRy:A9iIxuERzA83h09RZxYc5z6laOMWRHqr
- MD5 SHA1 SHA512 SSDEEP