Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
82b1d245fbece9cfdc2f4b2fc0ea6d57_JaffaCakes118.html
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
82b1d245fbece9cfdc2f4b2fc0ea6d57_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 82b1d245fbece9cfdc2f4b2fc0ea6d57_JaffaCakes118.html
- Size 139KB
- Sample240530-ca6plaac6w
- SHA256 9d6771f214219cba400e454b940779ddfac0f0ab9bba0d8cd12ed832271af091
- MD5 82b1d245fbece9cfdc2f4b2fc0ea6d57
- SHA1 0867a22a19915e9b3fd7a738179a4d8ea479ed04
- SHA512 80260a3993e172d38394b6ebd6ca03cae04bc0822101d23049b890abc4ed5940cd3f2cbe9174543f135c753e0fabe110340787a663a8ab543eb6b3f31b3a1104
- SSDEEP 1536:SArNsoQvj6Xlc9yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:SAroG+9yfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2628 msedge.exe 2628 msedge.exe 2364 msedge.exe 2364 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2364 msedge.exe 2364 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe 2364 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 1472 2364 msedge.exe 82 PID 2364 wrote to memory of 1472 2364 msedge.exe 82 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 1800 2364 msedge.exe 83 PID 2364 wrote to memory of 2628 2364 msedge.exe 84 PID 2364 wrote to memory of 2628 2364 msedge.exe 84 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85 PID 2364 wrote to memory of 2864 2364 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\82b1d245fbece9cfdc2f4b2fc0ea6d57_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0b3546f8,0x7ffc0b354708,0x7ffc0b3547182⤵PID:1472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5900133362692575642,14857619948409947867,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:1800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,5900133362692575642,14857619948409947867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,5900133362692575642,14857619948409947867,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵PID:2864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5900133362692575642,14857619948409947867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:2776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5900133362692575642,14857619948409947867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5900133362692575642,14857619948409947867,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4980 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3144
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1208
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
- MD5 4b4f91fa1b362ba5341ecb2836438dea
- SHA1 9561f5aabed742404d455da735259a2c6781fa07
- SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
- MD5 eaa3db555ab5bc0cb364826204aad3f0
- SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
- SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 aeda6025435444f9d15f684181a7ac2ef5f2364ffa7d01ff00add64c778b0a0e
- MD5 3ed639820f085b9b0077183812ffc02f
- SHA1 1b69a82dad51653ff1ec38981ac54826e934f45b
- SHA512 3ecb8e42c85550ae6834ecc375486e6e03c7f22f9618d63a7c98f4665156799fce18cc122d7020c23f733160486bd3aaeb37512bb1f60ed27c5b93c0b5347e88
- SSDEEP 96:nyk8vh1oDj0wpvWMoiVmdeHmQInUWQyV+VDCAiEwb:nykUh2Dj0GWMXYrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 2c2e9795943d40f59efad37b644926a2015d660800609086a0355c6ef38cb1f1
- MD5 1c83010d816543e58c09e8b5b2d6f393
- SHA1 e9340fca8613e4adf70fc111243d0b29628030ff
- SHA512 aac815223647e6363239bdeaa60fbc534ed1a96ac352ed36d59ca0bee82a897879c3e877dec4565a0821e263c35b7cdb80b6151c01bfab2db121fbbed0532410
- SSDEEP 96:nykRvh1oEj0wpvWMoiVmdeHmQInUWQyV+VDCziEwb:nykxh2Ej0GWMXYro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 f4b7e5b305c31d184feb702622b2ed3f49450da1fe5a106622a68a409580f6e2
- MD5 92897c79f11b7bdae2f57b52b3ae1cce
- SHA1 0b001a6e7e4de69b3d0c6e78a897f8a90fe4b9bb
- SHA512 1671e298aa77faf95319dbcbfcb2a7df7182e90931f910eff81c70c531cd6c1352b345ebe9fe1102de1dbac236ca567f19271b439cd6c2800de64763591535f2
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup2ae2RU6IKbtfYOxhZHnqTB:A9iIxuERzA83h09RZxY20ZRxTHqTMTtO
- MD5 SHA1 SHA512 SSDEEP