Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 14:05
Static task
static1
Behavioral task
behavioral1
Sample
8468f1e11147600f3ffea000c4926f53_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
8468f1e11147600f3ffea000c4926f53_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 8468f1e11147600f3ffea000c4926f53_JaffaCakes118.html
- Size 218KB
- Sample240530-recdwacc28
- SHA256 9571d98beff64fc73890888ec3cc935e334817fd5396a4408ebf2fc40c30e8b0
- MD5 8468f1e11147600f3ffea000c4926f53
- SHA1 bfa2d3d9cd4aba095fd453c2934fe9ba3d77c8c4
- SHA512 dbac8d6ec0b92dc18133e724cec2af6b58f5fa0e9f89e980ed5c3e54fe0c6a0423ae29a39a74da201a86af0912f949635e69e1fb0157c15391e58a96e6f9f18e
- SSDEEP 3072:SRlukjhnmeGmfyfkMY+BES09JXAnyrZalI+YQ:SRlNhnSmqsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1020 msedge.exe 1020 msedge.exe 1056 msedge.exe 1056 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1056 msedge.exe 1056 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1056 wrote to memory of 2320 1056 msedge.exe 81 PID 1056 wrote to memory of 2320 1056 msedge.exe 81 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1968 1056 msedge.exe 82 PID 1056 wrote to memory of 1020 1056 msedge.exe 83 PID 1056 wrote to memory of 1020 1056 msedge.exe 83 PID 1056 wrote to memory of 2172 1056 msedge.exe 84 PID 1056 wrote to memory of 2172 1056 msedge.exe 84 PID 1056 wrote to memory of 2172 1056 msedge.exe 84 PID 1056 wrote to memory of 2172 1056 msedge.exe 84 PID 1056 wrote to memory of 2172 1056 msedge.exe 84 PID 1056 wrote to memory of 2172 1056 msedge.exe 84 PID 1056 wrote to memory of 2172 1056 msedge.exe 84 PID 1056 wrote to memory of 2172 1056 msedge.exe 84 PID 1056 wrote to memory of 2172 1056 msedge.exe 84 PID 1056 wrote to memory of 2172 1056 msedge.exe 84 PID 1056 wrote to memory of 2172 1056 msedge.exe 84 PID 1056 wrote to memory of 2172 1056 msedge.exe 84 PID 1056 wrote to memory of 2172 1056 msedge.exe 84 PID 1056 wrote to memory of 2172 1056 msedge.exe 84 PID 1056 wrote to memory of 2172 1056 msedge.exe 84 PID 1056 wrote to memory of 2172 1056 msedge.exe 84 PID 1056 wrote to memory of 2172 1056 msedge.exe 84 PID 1056 wrote to memory of 2172 1056 msedge.exe 84 PID 1056 wrote to memory of 2172 1056 msedge.exe 84 PID 1056 wrote to memory of 2172 1056 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8468f1e11147600f3ffea000c4926f53_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8537f46f8,0x7ff8537f4708,0x7ff8537f47182⤵PID:2320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6799673925681213395,5563886182136725453,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:1968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,6799673925681213395,5563886182136725453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,6799673925681213395,5563886182136725453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 /prefetch:82⤵PID:2172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6799673925681213395,5563886182136725453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:3988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6799673925681213395,5563886182136725453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:3364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6799673925681213395,5563886182136725453,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3944
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1324
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2820
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
- MD5 ae54e9db2e89f2c54da8cc0bfcbd26bd
- SHA1 a88af6c673609ecbc51a1a60dfbc8577830d2b5d
- SHA512 e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
- MD5 f53207a5ca2ef5c7e976cbb3cb26d870
- SHA1 49a8cc44f53da77bb3dfb36fc7676ed54675db43
- SHA512 be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 cd9384bb8a5225c9e4168905c7e47be9c95f4cc6994626fc658857e5fc27ed4a
- MD5 0ec9174c731e45217ad5eee605ef9fbb
- SHA1 ca7e0274c03994e4b766bd476462d1afe23540e7
- SHA512 b9e6e5aa1eab93e86b95b371bbb9bb743c19fd877a0efa74a16b568c93154e33c77ad0bfe1683bfb1c75f188a18674868846207c744fc34d61aadaf18e2c3ecd
- SSDEEP 96:nxkM811QtPe8wpvWMoiVmdeHpw8EBAWUWQyV+VDCziEwb:nxk51itPe8GWMXpwcWro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 e5306c8d699fcbf49953145f896c5a863f6416d6757d7e98dd575844e8ab3e4b
- MD5 36d52f556bffd67164659a2f2a955e26
- SHA1 02885b7a9a9912a8989b972e37ddec39716fff71
- SHA512 7ca723980764f57d4e271e02a1fa58b30aa8b9de5b162b2018428876000cf138f35cd78a79658c46fbd9512d3ba3235b75ad38911b829ce5cc1504afb7552a34
- SSDEEP 96:nxk3811Qt8e8wpvWMoiVmdeHpw8EBAWUWQyV+VDCAiEwb:nxkM1it8e8GWMXpwcWrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 2be2de1361544f2e47217ead9f984f380640038c65ebd7e16a14afa5ab84b84b
- MD5 658d1f7102ca76ba5302bfe0aa244d17
- SHA1 920e62ae72e4d8896a137850d59fef3f7e300458
- SHA512 b6889dfd21311ff46dc78bbc7d15875dae05b1051f9b5684c61aa9eb4a47cdc9abccc5b2a983aed8977caf4c8b6e4f24abf378405f2951bde5d0d926998dbfd3
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupnMfe2RU3J+kI3z2OMDCRHU:A9iIxuERzA83h09RZxYuQIaOMWRHqlWK
- MD5 SHA1 SHA512 SSDEEP