Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 14:05
Static task
static1
Behavioral task
behavioral1
Sample
846833a21dc628aae0dcf235fba8f545_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
846833a21dc628aae0dcf235fba8f545_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 846833a21dc628aae0dcf235fba8f545_JaffaCakes118.html
- Size 23KB
- Sample240530-rdspgaba8v
- SHA256 34e9bbec72aba40db2f4801b7a477d825e0cff47e573d1376dfd2b4e3b91ac43
- MD5 846833a21dc628aae0dcf235fba8f545
- SHA1 5d86ea97ac9ae590ff709e6977eec0387a13dd26
- SHA512 5023d604c6e1d0a045168804faa8d4e0149150a315111e2ecb0947e37f2d247f5f9c360e091d45de51136c05fdecbcbd4026885040fd8a061efb110acaec3024
- SSDEEP 192:l5onxuVxZCRrU0g5X4GthH+i0c4VQnHeJVEMNqSlgT9QZxJtlM3qlAfagzJ828bb:4nxuVxZ2rUdIGth5alLRtlM6lAf/81h
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3940 msedge.exe 3940 msedge.exe 1068 msedge.exe 1068 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1068 msedge.exe 1068 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1068 wrote to memory of 2436 1068 msedge.exe 80 PID 1068 wrote to memory of 2436 1068 msedge.exe 80 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 4816 1068 msedge.exe 81 PID 1068 wrote to memory of 3940 1068 msedge.exe 82 PID 1068 wrote to memory of 3940 1068 msedge.exe 82 PID 1068 wrote to memory of 540 1068 msedge.exe 83 PID 1068 wrote to memory of 540 1068 msedge.exe 83 PID 1068 wrote to memory of 540 1068 msedge.exe 83 PID 1068 wrote to memory of 540 1068 msedge.exe 83 PID 1068 wrote to memory of 540 1068 msedge.exe 83 PID 1068 wrote to memory of 540 1068 msedge.exe 83 PID 1068 wrote to memory of 540 1068 msedge.exe 83 PID 1068 wrote to memory of 540 1068 msedge.exe 83 PID 1068 wrote to memory of 540 1068 msedge.exe 83 PID 1068 wrote to memory of 540 1068 msedge.exe 83 PID 1068 wrote to memory of 540 1068 msedge.exe 83 PID 1068 wrote to memory of 540 1068 msedge.exe 83 PID 1068 wrote to memory of 540 1068 msedge.exe 83 PID 1068 wrote to memory of 540 1068 msedge.exe 83 PID 1068 wrote to memory of 540 1068 msedge.exe 83 PID 1068 wrote to memory of 540 1068 msedge.exe 83 PID 1068 wrote to memory of 540 1068 msedge.exe 83 PID 1068 wrote to memory of 540 1068 msedge.exe 83 PID 1068 wrote to memory of 540 1068 msedge.exe 83 PID 1068 wrote to memory of 540 1068 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\846833a21dc628aae0dcf235fba8f545_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff739b46f8,0x7fff739b4708,0x7fff739b47182⤵PID:2436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14266511517835398408,17966586239922678834,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:22⤵PID:4816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,14266511517835398408,17966586239922678834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,14266511517835398408,17966586239922678834,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14266511517835398408,17966586239922678834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14266511517835398408,17966586239922678834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:3440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14266511517835398408,17966586239922678834,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1480 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3848
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2832
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
- MD5 2daa93382bba07cbc40af372d30ec576
- SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
- SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
- MD5 ecdc2754d7d2ae862272153aa9b9ca6e
- SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
- SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 08719c31a3f906339c65c5aa34f7ed4853551cefab635bc955d12196ce1b0a32
- MD5 9439c801eb7336be10827387af7313b0
- SHA1 fb94ef50758084caf82eebeac37dd28359ac7597
- SHA512 3b8bacee99f587a8afe5444df66e718c2906cbda9deb1393a554aa3db50c81ce30a64b391ecb575ead21454f7013fc32ff77a35f9abfaf6f3e74557a7390de34
- SSDEEP 96:ndkjz+v1m73wpvWMoiVmdeHplwtIacnGUWQyV+VDCziEwb:ndkkkjGWMXpRXGro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 7ee437635b7c35dae62ce30251c9aca73237b65d0664ebfd3a5df64806bfc9a3
- MD5 6b6f8228fb7c31be3e68eecca0f9e0c6
- SHA1 ffe4d2f4f1860bb85f6014263219ea6acd2444f8
- SHA512 43e30276674fc5d92a122439ea4b40916cd964c5511771124a4bdecafc1e1b864ba72460a6b19eff7df30874f814c7bc4a8cbfa7ceb1282781f2c3a63269aadd
- SSDEEP 96:ndkjzVv1me3wpvWMoiVmde0qplwtIacnGUWQyV+VDCAiEwb:ndkFkeGWMEqpRXGrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 d1858dbf5e9a5535bec332c286f5dcc210d720811546f4f0d14da3385a02cc97
- MD5 77c2cdc6428183e9447a46ea371e3370
- SHA1 b68338c098a4535cd407d8ece86f4778cb111482
- SHA512 94dada93610d89cd5e559e192c14d969ec31997523b752193b9923a5bc0a3ab44be62be4e134b17b8dbe15971c32db3ea56c2b71b6133eda661fe26bed235643
- SSDEEP 96:ndkjzVv1m73wpvWMoiVmde0qplwtIacnGUWQyV+VDCAiEwb:ndkFkjGWMEqpRXGrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 df7a1c5420e9c4420093a2500cda312029a1458d72ccb78a58695b4bec0b2d73
- MD5 b0cd01ece6b78df0d23475d83cc2b7a5
- SHA1 eb9a4ed4ecd6ab663c49bbd10cbf68bd84af4b08
- SHA512 92d42dcf7f37c2c7ead6a4260414f129ea596d0d06549746a71d2e87cb0cd80c689ca35f201b483b47bac0ca9f3da83910fe10c12af82cd72510ab2fe3bc6955
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupJZe2RU+N2ZBM3z2OMDCRH8:A9iIxuERzA83h09RZxYnUBMaOMWRHqlD
- MD5 SHA1 SHA512 SSDEEP