Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 20:47
Static task
static1
Behavioral task
behavioral1
Sample
81de130b73ec225f16e24e218fdc1002_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
81de130b73ec225f16e24e218fdc1002_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 81de130b73ec225f16e24e218fdc1002_JaffaCakes118.html
- Size 165KB
- Sample240529-zlcl8aab67
- SHA256 74ff169ac0eb7d0d4078daf0377b820dae429d8e482a9c7c42ca654b2fe19972
- MD5 81de130b73ec225f16e24e218fdc1002
- SHA1 d3468dbe09b9dbb158d9484dc4ab57ce49dd81dd
- SHA512 fbec63a3193a302ea881a068857b10ef87e3eca001921654d8f49ec8e50fbfad47a14ffb2931098cf753999c1c4573d443ac5bc11fc29433d611c1ff3854aa58
- SSDEEP 3072:SgskR1SKIayfkMY+BES09JXAnyrZalI+YQ:SgsgTI/sMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3716 msedge.exe 3716 msedge.exe 1040 msedge.exe 1040 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1040 msedge.exe 1040 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1040 wrote to memory of 1920 1040 msedge.exe 81 PID 1040 wrote to memory of 1920 1040 msedge.exe 81 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 1228 1040 msedge.exe 83 PID 1040 wrote to memory of 3716 1040 msedge.exe 84 PID 1040 wrote to memory of 3716 1040 msedge.exe 84 PID 1040 wrote to memory of 3336 1040 msedge.exe 85 PID 1040 wrote to memory of 3336 1040 msedge.exe 85 PID 1040 wrote to memory of 3336 1040 msedge.exe 85 PID 1040 wrote to memory of 3336 1040 msedge.exe 85 PID 1040 wrote to memory of 3336 1040 msedge.exe 85 PID 1040 wrote to memory of 3336 1040 msedge.exe 85 PID 1040 wrote to memory of 3336 1040 msedge.exe 85 PID 1040 wrote to memory of 3336 1040 msedge.exe 85 PID 1040 wrote to memory of 3336 1040 msedge.exe 85 PID 1040 wrote to memory of 3336 1040 msedge.exe 85 PID 1040 wrote to memory of 3336 1040 msedge.exe 85 PID 1040 wrote to memory of 3336 1040 msedge.exe 85 PID 1040 wrote to memory of 3336 1040 msedge.exe 85 PID 1040 wrote to memory of 3336 1040 msedge.exe 85 PID 1040 wrote to memory of 3336 1040 msedge.exe 85 PID 1040 wrote to memory of 3336 1040 msedge.exe 85 PID 1040 wrote to memory of 3336 1040 msedge.exe 85 PID 1040 wrote to memory of 3336 1040 msedge.exe 85 PID 1040 wrote to memory of 3336 1040 msedge.exe 85 PID 1040 wrote to memory of 3336 1040 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\81de130b73ec225f16e24e218fdc1002_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8b8946f8,0x7ffc8b894708,0x7ffc8b8947182⤵PID:1920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,1844592088979294613,13676789760724784712,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:22⤵PID:1228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,1844592088979294613,13676789760724784712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,1844592088979294613,13676789760724784712,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:82⤵PID:3336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1844592088979294613,13676789760724784712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:1652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1844592088979294613,13676789760724784712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,1844592088979294613,13676789760724784712,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5016 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4924
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4824
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
- MD5 1ac52e2503cc26baee4322f02f5b8d9c
- SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
- SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
- MD5 b2a1398f937474c51a48b347387ee36a
- SHA1 922a8567f09e68a04233e84e5919043034635949
- SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 003062cbc0f016c30627b1004c1e09abfeac93f5afcf229191817fa6d55cf4a7
- MD5 b7d9519b18fe471ccc372c761bb5184a
- SHA1 927b207e62b87665ae2be734f28527a1d440eb4b
- SHA512 5b4d4dbe952f75598ff9b76592d2ebea280c0669627a6ca8f574b8ec4ff77497c1bec5312da228a3e0d56f9bbb480c50f4b58957979ae6d3ba39899b0514c1cf
- SSDEEP 96:n7k50Q1k6ega9IQwpvWMoiVmdeHpCrtbtPUWQyV+VDCziEwb:n7kLdNaCQGWMXp+b9ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 130c3b9e513f505bdb5d831678c6155d556617d95d62270fbcfc6ffae322d44f
- MD5 2ac83207f663b72ffaeab99abfaeffae
- SHA1 cbc7ab644d8feca0e447cf05e7708f04de2361b7
- SHA512 97adad4f5315b3a553857518d1bfa459675b767164bf062919873b4f3f11df074aeb3339c55e50b5163179b3e488dd4076bfd2b8fa1261b0f9b94156f865b3f5
- SSDEEP 96:n7kE0Q1k6vga9IQwpvWMoiVmdeHpCrtbtPUWQyV+VDCAiEwb:n7k0doaCQGWMXp+b9rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 99551f67593ddc8727830a945990e0244639bd3f4566532c5503862a7078d075
- MD5 fce0205108f2b98141fc35e9b91d5aa1
- SHA1 75085052d0fcd832ce13b56a8f752b28b2e0f20d
- SHA512 255e1f56a7bf8c1a4d72d6d341211281954741fad8cae323282601e6758d31de9d3da04d5337f96555397100eefe434f39a4769e5d016a22d798a41273e52dcf
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupukHe2RUB5jf7ZgM3z2OMDD:A9iIxuERzA83h09RZxYukvI9zZgMaOMX
- MD5 SHA1 SHA512 SSDEEP