Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 13:32
Static task
static1
Behavioral task
behavioral1
Sample
84534fd9879dffb1aab887fa3923c52a_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
84534fd9879dffb1aab887fa3923c52a_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 84534fd9879dffb1aab887fa3923c52a_JaffaCakes118.html
- Size 125KB
- Sample240530-qtebcabd57
- SHA256 7a3af5c5a48ffa35cd4b2fa5f2ee150eb8df6497d65c36066f1a57d4db802322
- MD5 84534fd9879dffb1aab887fa3923c52a
- SHA1 d91e4daa24d369e5ed897d25af892a0547c5b6ce
- SHA512 187fef608f3e8c69113df833f1e23cb0e1197ceb75a19f30eb3fe4fc2e0f8cf802d9f346f84dbef4bed1df0ae1ec744cba980e10d1fdbc42ca8ffbfc7acfefb3
- SSDEEP 1536:SnvHVcliEyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:SWyfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4732 msedge.exe 4732 msedge.exe 1924 msedge.exe 1924 msedge.exe 1440 msedge.exe 1440 msedge.exe 1440 msedge.exe 1440 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1924 msedge.exe 1924 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 716 1924 msedge.exe 82 PID 1924 wrote to memory of 716 1924 msedge.exe 82 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 2748 1924 msedge.exe 83 PID 1924 wrote to memory of 4732 1924 msedge.exe 84 PID 1924 wrote to memory of 4732 1924 msedge.exe 84 PID 1924 wrote to memory of 4588 1924 msedge.exe 85 PID 1924 wrote to memory of 4588 1924 msedge.exe 85 PID 1924 wrote to memory of 4588 1924 msedge.exe 85 PID 1924 wrote to memory of 4588 1924 msedge.exe 85 PID 1924 wrote to memory of 4588 1924 msedge.exe 85 PID 1924 wrote to memory of 4588 1924 msedge.exe 85 PID 1924 wrote to memory of 4588 1924 msedge.exe 85 PID 1924 wrote to memory of 4588 1924 msedge.exe 85 PID 1924 wrote to memory of 4588 1924 msedge.exe 85 PID 1924 wrote to memory of 4588 1924 msedge.exe 85 PID 1924 wrote to memory of 4588 1924 msedge.exe 85 PID 1924 wrote to memory of 4588 1924 msedge.exe 85 PID 1924 wrote to memory of 4588 1924 msedge.exe 85 PID 1924 wrote to memory of 4588 1924 msedge.exe 85 PID 1924 wrote to memory of 4588 1924 msedge.exe 85 PID 1924 wrote to memory of 4588 1924 msedge.exe 85 PID 1924 wrote to memory of 4588 1924 msedge.exe 85 PID 1924 wrote to memory of 4588 1924 msedge.exe 85 PID 1924 wrote to memory of 4588 1924 msedge.exe 85 PID 1924 wrote to memory of 4588 1924 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\84534fd9879dffb1aab887fa3923c52a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe344246f8,0x7ffe34424708,0x7ffe344247182⤵PID:716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,6655618899701384926,3943277479438595653,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵PID:2748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,6655618899701384926,3943277479438595653,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,6655618899701384926,3943277479438595653,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:82⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6655618899701384926,3943277479438595653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:1744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6655618899701384926,3943277479438595653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:4396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,6655618899701384926,3943277479438595653,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1440
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3896
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
- MD5 537815e7cc5c694912ac0308147852e4
- SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
- SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
- MD5 8b167567021ccb1a9fdf073fa9112ef0
- SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
- SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 93f0691aac773f6f9026f925b4bbd4ab4bf36286fa52b6d8b46747327b9c0376
- MD5 23b2c9c5e5630777dc0774a98d63e6a7
- SHA1 2e53490369e1e7806be8d2665a24df5fea5ed8ec
- SHA512 d81b1ca3ff04c445c3c8a6c80e9b2d6193099a921f09504941a628152e1492f96723a5792465c61b20fbf587bf7372bc9dd981ac46480892e9d33ed5daea1170
- SSDEEP 96:n4k3Jcw1qC9wpvWMoiVmdeHpRQjyUWQyV+VDCAiEwb:n4kF0C9GWMXpeyrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 ad04dc755b6e85add9e64f0703a38beaf250383089b74d6685dd982933470461
- MD5 f6d57c9a22c452cc05a81ee9260638ef
- SHA1 99439f0893e5057e47dbadf099e9ad140ac2606d
- SHA512 687df5291a7931bda46e4066cf73e3b3abe545f9e047af16f4200de80d600e15d828c0ed567d4bcf4e383a993f0e2943b8f3774f3be8c9c6c87c64b9636f2302
- SSDEEP 96:n4kMJcw1qD9wpvWMoiVmdeHpRQjyUWQyV+VDCziEwb:n4kc0D9GWMXpeyro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 d4910c0f8af5dd20109978652a379595d6725716fe8856cbac1f93570f62cbd3
- MD5 09cf337aaf657a749abedafad07822be
- SHA1 1afd42e97b9317ae587df5aff3b2a68d2fffc11f
- SHA512 87bd2061f89303145a9e050dfb09a2614d6cc81a0f3b1d5b152c884ae57b2c892dc011a75f5b8f5ff735267d7a4a189c7c1d769dc3801271392ea991fadf20e4
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupqBe2RUg/qTe3z2OMDCRHqi:A9iIxuERzA83h09RZxYqVZYeaOMWRHqi
- MD5 SHA1 SHA512 SSDEEP