Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 02:02
Static task
static1
Behavioral task
behavioral1
Sample
82b6a33af2d07d76a1e9c7dd22c1eec3_JaffaCakes118.html
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
82b6a33af2d07d76a1e9c7dd22c1eec3_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 82b6a33af2d07d76a1e9c7dd22c1eec3_JaffaCakes118.html
- Size 170KB
- Sample240530-cgakqsbe73
- SHA256 df0a546f20781e84406bf21e84da8ac6666e290041430bbec6b97f20257508cb
- MD5 82b6a33af2d07d76a1e9c7dd22c1eec3
- SHA1 74f3178468fb92c8779390dd3da06cd42f6b6c5c
- SHA512 b0f2d148ee5f85d1ba4aba75400d2e1edacac94e1c1cd8860897874216d53c137fd25cafd0b2fb9eea05346ac97f3f10c4693143d4c40fdf5607e99e2434b4b3
- SSDEEP 3072:Sgma6RfMBLyfkMY+BES09JXAnyrZalI+YQ:SgmJRfMBusMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1712 msedge.exe 1712 msedge.exe 4668 msedge.exe 4668 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4668 msedge.exe 4668 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4668 wrote to memory of 2456 4668 msedge.exe 81 PID 4668 wrote to memory of 2456 4668 msedge.exe 81 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 4772 4668 msedge.exe 82 PID 4668 wrote to memory of 1712 4668 msedge.exe 83 PID 4668 wrote to memory of 1712 4668 msedge.exe 83 PID 4668 wrote to memory of 1964 4668 msedge.exe 84 PID 4668 wrote to memory of 1964 4668 msedge.exe 84 PID 4668 wrote to memory of 1964 4668 msedge.exe 84 PID 4668 wrote to memory of 1964 4668 msedge.exe 84 PID 4668 wrote to memory of 1964 4668 msedge.exe 84 PID 4668 wrote to memory of 1964 4668 msedge.exe 84 PID 4668 wrote to memory of 1964 4668 msedge.exe 84 PID 4668 wrote to memory of 1964 4668 msedge.exe 84 PID 4668 wrote to memory of 1964 4668 msedge.exe 84 PID 4668 wrote to memory of 1964 4668 msedge.exe 84 PID 4668 wrote to memory of 1964 4668 msedge.exe 84 PID 4668 wrote to memory of 1964 4668 msedge.exe 84 PID 4668 wrote to memory of 1964 4668 msedge.exe 84 PID 4668 wrote to memory of 1964 4668 msedge.exe 84 PID 4668 wrote to memory of 1964 4668 msedge.exe 84 PID 4668 wrote to memory of 1964 4668 msedge.exe 84 PID 4668 wrote to memory of 1964 4668 msedge.exe 84 PID 4668 wrote to memory of 1964 4668 msedge.exe 84 PID 4668 wrote to memory of 1964 4668 msedge.exe 84 PID 4668 wrote to memory of 1964 4668 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\82b6a33af2d07d76a1e9c7dd22c1eec3_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbac3746f8,0x7ffbac374708,0x7ffbac3747182⤵PID:2456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,13187766503449098863,16867689335405752468,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:22⤵PID:4772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,13187766503449098863,16867689335405752468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,13187766503449098863,16867689335405752468,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:82⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13187766503449098863,16867689335405752468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:2684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13187766503449098863,16867689335405752468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,13187766503449098863,16867689335405752468,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4968
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2680
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
- MD5 4f7152bc5a1a715ef481e37d1c791959
- SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
- SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
- MD5 ea98e583ad99df195d29aa066204ab56
- SHA1 f89398664af0179641aa0138b337097b617cb2db
- SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 111B
- SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
- MD5 807419ca9a4734feaf8d8563a003b048
- SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
- SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 b0f8ef22cc0f62451a5338462fe703e7d6cecbf5c16d03cb35441612e36a6be4
- MD5 b2433f5dc452f3475f94474224b0fab0
- SHA1 ce573b63b2596ecde8868cf26608b38d601ef691
- SHA512 86d68ef1471d2445ffa2fa2d67398383fbb666392c80dae4e0ff80123109daace87ede9d1220bd0074cc97026e2065edba150b3420b00a9262b1f4c602b7dab8
- SSDEEP 96:nwksD1jnH3XwpvWMoiVmdeHp1kt5UWQyV+VDCziEwb:nwk2JXXGWMXpc5ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 5e187446926bac6dfd77548d0dc253661b0942848cc0ed9befb5a7d2d7db14b7
- MD5 e88fb10a813b8e6a24482199ac26c5f3
- SHA1 f675ba8fc100c5c7362afdcf0047ca0da860b5e7
- SHA512 3f66373a596d3e6d6e88391c81e22770e414e32f30713654aa496c2cb6e1a4601d0cff0e3da6cbefe54e5df61b8ac3eeb49e345625d24f70776c0752957bccfb
- SSDEEP 96:nwkXD1jnE3XwpvWMoiVmdeHp1kt5UWQyV+VDCAiEwb:nwkTJQXGWMXpc5rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 b38aee89ace72ef51c0a6ea534c8bc22567106793508b73713fae859cb920799
- MD5 2a24393b0bd940949e0a598325fa0d71
- SHA1 1992f69cc71115210c623ddd53d0ba2874adc146
- SHA512 19fab9422f377596a21208829811974a059a93277fa4eb82bab7a9b6f7625ca57162485c1c916027bb1205c33ab34277e43dc2768ea2141001af755a1e0d92bc
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupG7Ze2RUro5sM3z2OMDCRHD:A9iIxuERzA83h09RZxYGxJsMaOMWRHqS
- MD5 SHA1 SHA512 SSDEEP