Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 14:02
Static task
static1
Behavioral task
behavioral1
Sample
8466658e27e64258501f7b5cc713127c_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
8466658e27e64258501f7b5cc713127c_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 8466658e27e64258501f7b5cc713127c_JaffaCakes118.html
- Size 140KB
- Sample240530-rcfzaaba5t
- SHA256 43119babb807af7298f5cde1405dd35b0b810910e72f5cac3427b814ca5a769d
- MD5 8466658e27e64258501f7b5cc713127c
- SHA1 a758c39c3abd01aab96092af42c4f6036a67bf2f
- SHA512 b333d7e752f6180b545f2d2460fb40269c11a6cd2eab2a2828a67440b8ff2e04087bd15c510544142eb89ee18f880464e68138fc804db994e5bb664cf2c43490
- SSDEEP 1536:S2j9fzlu8yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:S2jq8yfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5016 msedge.exe 5016 msedge.exe 2128 msedge.exe 2128 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2128 msedge.exe 2128 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe 2128 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2128 wrote to memory of 1504 2128 msedge.exe 83 PID 2128 wrote to memory of 1504 2128 msedge.exe 83 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 4492 2128 msedge.exe 84 PID 2128 wrote to memory of 5016 2128 msedge.exe 85 PID 2128 wrote to memory of 5016 2128 msedge.exe 85 PID 2128 wrote to memory of 4376 2128 msedge.exe 86 PID 2128 wrote to memory of 4376 2128 msedge.exe 86 PID 2128 wrote to memory of 4376 2128 msedge.exe 86 PID 2128 wrote to memory of 4376 2128 msedge.exe 86 PID 2128 wrote to memory of 4376 2128 msedge.exe 86 PID 2128 wrote to memory of 4376 2128 msedge.exe 86 PID 2128 wrote to memory of 4376 2128 msedge.exe 86 PID 2128 wrote to memory of 4376 2128 msedge.exe 86 PID 2128 wrote to memory of 4376 2128 msedge.exe 86 PID 2128 wrote to memory of 4376 2128 msedge.exe 86 PID 2128 wrote to memory of 4376 2128 msedge.exe 86 PID 2128 wrote to memory of 4376 2128 msedge.exe 86 PID 2128 wrote to memory of 4376 2128 msedge.exe 86 PID 2128 wrote to memory of 4376 2128 msedge.exe 86 PID 2128 wrote to memory of 4376 2128 msedge.exe 86 PID 2128 wrote to memory of 4376 2128 msedge.exe 86 PID 2128 wrote to memory of 4376 2128 msedge.exe 86 PID 2128 wrote to memory of 4376 2128 msedge.exe 86 PID 2128 wrote to memory of 4376 2128 msedge.exe 86 PID 2128 wrote to memory of 4376 2128 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8466658e27e64258501f7b5cc713127c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff631e46f8,0x7fff631e4708,0x7fff631e47182⤵PID:1504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,6164873429812605888,9711867108008818212,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:4492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,6164873429812605888,9711867108008818212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,6164873429812605888,9711867108008818212,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:82⤵PID:4376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6164873429812605888,9711867108008818212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:2612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6164873429812605888,9711867108008818212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:3288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,6164873429812605888,9711867108008818212,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:212
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5104
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
- MD5 56641592f6e69f5f5fb06f2319384490
- SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
- SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
- MD5 612a6c4247ef652299b376221c984213
- SHA1 d306f3b16bde39708aa862aee372345feb559750
- SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 e940b0566073925683934f3bcf938f97336777868457bc88fc5193cee3d1a24c
- MD5 d71277141b986e6c5397ce0e56acfc7a
- SHA1 c38cad63b99d8ced599e4f6242d53d29c53d658f
- SHA512 3f51e7aacf9c8ebbc491876390afa4f8b3cd7f80be3b9d85c6c18e21ee65619551e2ea88e02c2c0fe38ef63b776cc5d430cc65549e0da5a15c3c2d1751cbef13
- SSDEEP 96:nekRc1672wpvWMoiVmdeHk4XZUWQyV+VDCziEwb:nekaE72GWMXJZro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 9d2568de0f1f7cbfbccf9f832f57fd7075e9d5546e179f94aedb283ab58ea189
- MD5 2507e399e2cbf65ca09b5d7b50cdf547
- SHA1 93cb8bdb456d646faeb29c44ae4ca7b400aa9544
- SHA512 9fe08f02d4bee0c7e520becaee549d89eb9ec67be2140d3d62006026ee323069a0b9887bcc662eda821ebe1344267dc3a0d569bc3e0e15caa86dee1a85e2807b
- SSDEEP 96:nek8c16K2wpvWMoiVmdeHk4XZUWQyV+VDCAiEwb:neklEK2GWMXJZrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 d7190ba1e07fbf77e6b864e0949841370f1cc4e489c356cfcce38b01cbb70a3c
- MD5 058841eafe865e6ed7b490347456ff4a
- SHA1 64c9e5adcef4ed3024ce20f44e608b80aa1161bf
- SHA512 96636c06c7e8b59abd5d4fb805965dd62e814162535e4de13bcdcb9e06f44d39c27ff1a1c87b04e32859b21cf713a2b079da4c2b787c9e19cc60de90351d0f9e
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupBge2RUCy4VH3z2OMDCRHqD:A9iIxuERzA83h09RZxYUNHaOMWRHqlWG
- MD5 SHA1 SHA512 SSDEEP