Analysis
- max time kernel
145s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 13:38
Static task
static1
Behavioral task
behavioral1
Sample
84584cec884eedd30dd93182c8390837_JaffaCakes118.html
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
84584cec884eedd30dd93182c8390837_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 84584cec884eedd30dd93182c8390837_JaffaCakes118.html
- Size 133KB
- Sample240530-qxtv7sbe83
- SHA256 b9031b41962408d5a475f4111494a3d6febcf6af107b9b193c3bd93b41fcbd3b
- MD5 84584cec884eedd30dd93182c8390837
- SHA1 74a84756a0dde7b2c85dff5e27a4628ede038912
- SHA512 099afa31353c5c285add379ebdf331d16eee02a4c4ba6b5b5768ec1b748bfe55647d88c44af19e5644489498eec558d01c1a7a56c71b68d05666a4e8c3e5b4c7
- SSDEEP 3072:StWpj02NMz1zwfmVU+P92xE6x2X0zk4bJU79Ct5ugV0rnBtz:StDz1zwfmVU+P92xE6x2X0zk4bJU79Ck
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2424 msedge.exe 2424 msedge.exe 4904 msedge.exe 4904 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4904 wrote to memory of 4560 4904 msedge.exe 83 PID 4904 wrote to memory of 4560 4904 msedge.exe 83 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 4568 4904 msedge.exe 84 PID 4904 wrote to memory of 2424 4904 msedge.exe 85 PID 4904 wrote to memory of 2424 4904 msedge.exe 85 PID 4904 wrote to memory of 2968 4904 msedge.exe 86 PID 4904 wrote to memory of 2968 4904 msedge.exe 86 PID 4904 wrote to memory of 2968 4904 msedge.exe 86 PID 4904 wrote to memory of 2968 4904 msedge.exe 86 PID 4904 wrote to memory of 2968 4904 msedge.exe 86 PID 4904 wrote to memory of 2968 4904 msedge.exe 86 PID 4904 wrote to memory of 2968 4904 msedge.exe 86 PID 4904 wrote to memory of 2968 4904 msedge.exe 86 PID 4904 wrote to memory of 2968 4904 msedge.exe 86 PID 4904 wrote to memory of 2968 4904 msedge.exe 86 PID 4904 wrote to memory of 2968 4904 msedge.exe 86 PID 4904 wrote to memory of 2968 4904 msedge.exe 86 PID 4904 wrote to memory of 2968 4904 msedge.exe 86 PID 4904 wrote to memory of 2968 4904 msedge.exe 86 PID 4904 wrote to memory of 2968 4904 msedge.exe 86 PID 4904 wrote to memory of 2968 4904 msedge.exe 86 PID 4904 wrote to memory of 2968 4904 msedge.exe 86 PID 4904 wrote to memory of 2968 4904 msedge.exe 86 PID 4904 wrote to memory of 2968 4904 msedge.exe 86 PID 4904 wrote to memory of 2968 4904 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\84584cec884eedd30dd93182c8390837_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc002046f8,0x7ffc00204708,0x7ffc002047182⤵PID:4560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,16344337221888983844,4126532063549826069,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:22⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,16344337221888983844,4126532063549826069,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,16344337221888983844,4126532063549826069,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:82⤵PID:2968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,16344337221888983844,4126532063549826069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:3748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,16344337221888983844,4126532063549826069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:1780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,16344337221888983844,4126532063549826069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:12⤵PID:3728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,16344337221888983844,4126532063549826069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:12⤵PID:3392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,16344337221888983844,4126532063549826069,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3740 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5104
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1464
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
- MD5 a8e767fd33edd97d306efb6905f93252
- SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
- SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
- MD5 439b5e04ca18c7fb02cf406e6eb24167
- SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
- SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 111B
- SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
- MD5 807419ca9a4734feaf8d8563a003b048
- SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
- SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 304B
- SHA256 8a33eec96a075eeb43a5ccda02aca9cfbe78d00d498c26123a31352ef2647db0
- MD5 840f2132910d64cc65a17d9c46d399e8
- SHA1 df65478497c1194fcd3f35f221e6bde6efbc1545
- SHA512 c61c5d5366c49e1cd5bfe0042dee8aedc55f785086f43a3413624c45db6765e7901207190175eb04410d2604ea8775af4ee87eee519c77eb6920cd08a5d65d25
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 524244dcb50081b67faab338612d5b93405b1286b326b55a26bb8fb9d0b43c0a
- MD5 f27e70f928aafe05963926fa6096d86f
- SHA1 781135e2a4397208bacf23c4afa17bb537acde8b
- SHA512 495015607dc4a1fe10c79fa2a4ba77bff220db272b5af04497e5123cdc5113f5094c12bc8bf11a38eb61167d0bfa61b030c1c58fd4e39129c89992347b7ee82e
- SSDEEP 96:nNkTc1CIlwpvWMoiVmdeHBrzA+KUWQyV+VDCziEwb:nNkowIlGWMXNKro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 df28cd29c0177fe7ab5f0257be0935bfc717a2e8f85b40be0e381d67f3037685
- MD5 b02d17759f13a546d15a9b9de57dc799
- SHA1 12181c1515b72b335dbc21128642fb06613dbd9b
- SHA512 88ccfd8e4b6c78bbc0df523fccaccf92f883e0a4a8f6bee13556fa8f9235179c1d8d472f4c5cb361cf4eb0799ea181b7d31a5c64fc22875093b52bd4dc33d42b
- SSDEEP 96:nNkgc1CIlwpvWMoiVmde81B42BrzA+KUWQyV+VDCAiEwb:nNkhwIlGWMMb42NKrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 7e7ca9711e745da65e9ba5060cac351a88e2ead3f795325f0c2f9e1ec40caf76
- MD5 b92858d940eadd81162aa87ec75fbdf6
- SHA1 d37450caca433f0641dc6db46c13b7e63fcccf1c
- SHA512 35f5a08b57df72e953a4e954686b5832f2b4358652b7fa47f5f5ff6f18361a3ebb5e0ffdfb13f7ff30055e155ec45209eb6ea800bd1577069b7aa344d2986278
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupwoHre2RU5vMC2Sl3z2OMD/:A9iIxuERzA83h09RZxY7H7qUd6aOMWR0
- MD5 SHA1 SHA512 SSDEEP