Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 03:53
Static task
static1
Behavioral task
behavioral1
Sample
82f579ead77431c7f8c963fb2702be5f_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
82f579ead77431c7f8c963fb2702be5f_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 82f579ead77431c7f8c963fb2702be5f_JaffaCakes118.html
- Size 18KB
- Sample240530-ef5etsde7s
- SHA256 3d79bd20227d53440357db431165c9f95a126bf9681aa3d7634073b9ebcd8dd0
- MD5 82f579ead77431c7f8c963fb2702be5f
- SHA1 fa55bec94d06cd5ffd1f78edf78785a42032b06d
- SHA512 626dcfb866479232803408d0533eb5918a45b39e8e4da48499f7f21085b949e0cbb48bf755ec85a602f33a27df03e1dc897684958e6813956a5b3dafa6d5992a
- SSDEEP 384:SIG/Biti1jFHj7FNVaPBJ6ztDv/HlTeygSw:SbitAvNUBJ6zFv/HKSw
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4220 msedge.exe 4220 msedge.exe 4524 msedge.exe 4524 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4524 msedge.exe 4524 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4524 wrote to memory of 2584 4524 msedge.exe 83 PID 4524 wrote to memory of 2584 4524 msedge.exe 83 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 3208 4524 msedge.exe 84 PID 4524 wrote to memory of 4220 4524 msedge.exe 85 PID 4524 wrote to memory of 4220 4524 msedge.exe 85 PID 4524 wrote to memory of 4960 4524 msedge.exe 86 PID 4524 wrote to memory of 4960 4524 msedge.exe 86 PID 4524 wrote to memory of 4960 4524 msedge.exe 86 PID 4524 wrote to memory of 4960 4524 msedge.exe 86 PID 4524 wrote to memory of 4960 4524 msedge.exe 86 PID 4524 wrote to memory of 4960 4524 msedge.exe 86 PID 4524 wrote to memory of 4960 4524 msedge.exe 86 PID 4524 wrote to memory of 4960 4524 msedge.exe 86 PID 4524 wrote to memory of 4960 4524 msedge.exe 86 PID 4524 wrote to memory of 4960 4524 msedge.exe 86 PID 4524 wrote to memory of 4960 4524 msedge.exe 86 PID 4524 wrote to memory of 4960 4524 msedge.exe 86 PID 4524 wrote to memory of 4960 4524 msedge.exe 86 PID 4524 wrote to memory of 4960 4524 msedge.exe 86 PID 4524 wrote to memory of 4960 4524 msedge.exe 86 PID 4524 wrote to memory of 4960 4524 msedge.exe 86 PID 4524 wrote to memory of 4960 4524 msedge.exe 86 PID 4524 wrote to memory of 4960 4524 msedge.exe 86 PID 4524 wrote to memory of 4960 4524 msedge.exe 86 PID 4524 wrote to memory of 4960 4524 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\82f579ead77431c7f8c963fb2702be5f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbaf3846f8,0x7ffbaf384708,0x7ffbaf3847182⤵PID:2584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,10935028349305207978,13806663844730514710,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:3208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,10935028349305207978,13806663844730514710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,10935028349305207978,13806663844730514710,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:82⤵PID:4960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10935028349305207978,13806663844730514710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:1368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10935028349305207978,13806663844730514710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,10935028349305207978,13806663844730514710,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3408
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:736
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
- MD5 4b4f91fa1b362ba5341ecb2836438dea
- SHA1 9561f5aabed742404d455da735259a2c6781fa07
- SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
- MD5 eaa3db555ab5bc0cb364826204aad3f0
- SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
- SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 be8cea295ab3847d4133d9efdd4107e60a2e4f4281a7ce3bea2b1c37dcd0651b
- MD5 d0f06ff9d004d31eccc6487fb09919a0
- SHA1 a9409a6658940581e78822b14b31175d50b1a6ab
- SHA512 f9a3c414d207e8f221ea175dc91a62ee4bc4c40adc108698e8db02cac19939358ca9d310d53283e32d85fa9a428b6046796d80f48ecb8b7b94364610e29dfaa1
- SSDEEP 96:nlk8gG1FDj0wpvWMoiVmdeHmQIMj4iUWQyV+VDCAiEwb:nlkeTDj0GWMXn9rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 8fab674a12e54699134b17cad3332035a28e27fb68a552fe6a82ad8689c1b352
- MD5 eec16e12d3de8bfec0c5fa28c9fe82e4
- SHA1 2119c5c3cbdea44e42fb4663b78f773538b66143
- SHA512 ed12b920de4df6009da42679450ac8a7f742ca1080cc00ab6b70a7778e9e1d411372f0d16e364a6ddee2332089ad0955e3b6313c4dc8a101a2572fb7735e9698
- SSDEEP 96:nlkRgG1FEj0wpvWMoiVmdeHmQIMj4iUWQyV+VDCziEwb:nlkFTEj0GWMXn9ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edb45f4a-eed5-4580-9694-2f36e5484945.tmp
- Size 11KB
- SHA256 b9784d4cdfc16b17a6ccb83dd6016306caf096045f172da16f4246567ad13a4a
- MD5 357ec402af32f96da9360d96d2ed8fc8
- SHA1 858292fbb2947dac1e27a626f40df957fc8a5a02
- SHA512 c20f82fd3e5d5dec49a49454b27f9e706ab1ff97dd4dbb00b3222ee48550c8a01af29400e4b1122969a1f10d3fd1e42ce3311de19323133fda9f267eae8a8652
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupGge2RUxIKbsfYOxhZHnqTv:A9iIxuERzA83h09RZxYG+y6xTHqTMTFo
- MD5 SHA1 SHA512 SSDEEP