Analysis
- max time kernel
145s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 14:08
Static task
static1
Behavioral task
behavioral1
Sample
846b2ed888db8596ee9dd6a885072785_JaffaCakes118.html
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
846b2ed888db8596ee9dd6a885072785_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 846b2ed888db8596ee9dd6a885072785_JaffaCakes118.html
- Size 85KB
- Sample240530-rf1svsbb61
- SHA256 071e52a3b3d29f45b4698373128a884f4a9a9c5a4af7d077ddbc729ea75ac5b8
- MD5 846b2ed888db8596ee9dd6a885072785
- SHA1 e718a3923f4a59932bc26ff0a748300ea5b5f78f
- SHA512 e9bc8fe278923207111d33b52ae76133a7883ca5866ac53227c31bc4d524c1f62e159bfeced76c0ea337d9b2a173457277d7a98bb3d117b842814076443aa47f
- SSDEEP 1536:nHv3kkNokAzt8k9NKJovIZeYr6ZCwMxTq4V8Qbi9a7iF5ZfwqrctJ:nHvbwzt8aNKBFAMwa7ivZfwqrc/
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1716 msedge.exe 1716 msedge.exe 3652 msedge.exe 3652 msedge.exe 4708 msedge.exe 4708 msedge.exe 4708 msedge.exe 4708 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3652 wrote to memory of 1128 3652 msedge.exe 81 PID 3652 wrote to memory of 1128 3652 msedge.exe 81 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 4524 3652 msedge.exe 82 PID 3652 wrote to memory of 1716 3652 msedge.exe 83 PID 3652 wrote to memory of 1716 3652 msedge.exe 83 PID 3652 wrote to memory of 3636 3652 msedge.exe 84 PID 3652 wrote to memory of 3636 3652 msedge.exe 84 PID 3652 wrote to memory of 3636 3652 msedge.exe 84 PID 3652 wrote to memory of 3636 3652 msedge.exe 84 PID 3652 wrote to memory of 3636 3652 msedge.exe 84 PID 3652 wrote to memory of 3636 3652 msedge.exe 84 PID 3652 wrote to memory of 3636 3652 msedge.exe 84 PID 3652 wrote to memory of 3636 3652 msedge.exe 84 PID 3652 wrote to memory of 3636 3652 msedge.exe 84 PID 3652 wrote to memory of 3636 3652 msedge.exe 84 PID 3652 wrote to memory of 3636 3652 msedge.exe 84 PID 3652 wrote to memory of 3636 3652 msedge.exe 84 PID 3652 wrote to memory of 3636 3652 msedge.exe 84 PID 3652 wrote to memory of 3636 3652 msedge.exe 84 PID 3652 wrote to memory of 3636 3652 msedge.exe 84 PID 3652 wrote to memory of 3636 3652 msedge.exe 84 PID 3652 wrote to memory of 3636 3652 msedge.exe 84 PID 3652 wrote to memory of 3636 3652 msedge.exe 84 PID 3652 wrote to memory of 3636 3652 msedge.exe 84 PID 3652 wrote to memory of 3636 3652 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\846b2ed888db8596ee9dd6a885072785_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8537f46f8,0x7ff8537f4708,0x7ff8537f47182⤵PID:1128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,10919663015568260030,10408794496135918944,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,10919663015568260030,10408794496135918944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,10919663015568260030,10408794496135918944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:82⤵PID:3636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10919663015568260030,10408794496135918944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:12⤵PID:4120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10919663015568260030,10408794496135918944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:3868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10919663015568260030,10408794496135918944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:12⤵PID:3100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,10919663015568260030,10408794496135918944,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4708
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2764
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1520
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
- MD5 ae54e9db2e89f2c54da8cc0bfcbd26bd
- SHA1 a88af6c673609ecbc51a1a60dfbc8577830d2b5d
- SHA512 e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
- MD5 f53207a5ca2ef5c7e976cbb3cb26d870
- SHA1 49a8cc44f53da77bb3dfb36fc7676ed54675db43
- SHA512 be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 96B
- SHA256 2f6429ff37d8532eb7b23683d5694b96a51fa11d4a0b7edbbcdda50ac9a0abe0
- MD5 662a7c896c5ce4712e449ba71b1229e3
- SHA1 67196726bfa6211dfa9195d3d7f49f8ca6b5dec5
- SHA512 6a33a4cf1d156aa4f8eed2b642504c37c2ad918ef302f6c526ea7e1e8987a64681ebfc1704c5ef3772b94f5fe436b47ecd4b7b824dd53d046fbc3bc9091f7348
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 1KB
- SHA256 efe2844cf50e155b98d0288c2098cb0fbda1c7b39dd2a940bb9bfdb9b8e93d1e
- MD5 62e90d5cecc0f2f782b340bf6c95c178
- SHA1 f5222f4c2bb4309b734d2287c686bc05cdfeb5e5
- SHA512 e2b9ec8656ea7e4063ca647d454cfab0c1a5726f68dc9a0429a1739bdd99a4bd3e415d725ac385576a1aca2015a70066ade96e0ebd875d2a2b57d87043dbbbe0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 a95e039df5df20502df622c5da86021aa64791ce7818841960ea2167c73cc59e
- MD5 c60e2b14936d97ae342e00a760312c48
- SHA1 68b347fe6ff2b89326adb4f48e3158f9713dcd3b
- SHA512 9a369fbcb4c6b40a7420804b121a96190c0b7ce4591cd3e4c69c29d0863ae53c30b1a019651e3808b39121a8bcc9081fb1e8e3571c87c19e082a69e3d5317556
- SSDEEP 96:nFkMP11ePe8wpvWMoiVmdeHpw8EaAxUWQyV+VDCziEwb:nFkm1sPe8GWMXpwVxro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 882424c4a1c5758fb034382c3e077c6dcd9f136f24273835477f54f38d92dddf
- MD5 2df073eb96b0cc17681e2a15aca96536
- SHA1 e13d17b81298c75ccca9be66bb914fa618c7b28b
- SHA512 fb590424c64b2bdc1b588c46f32fac4f3516594983752d8993bf7d6318e70cf94c580bc6e6f546973226d65589b7100868390359c218bdc854e92e5907088981
- SSDEEP 96:nFk3P11ePe8wpvWMoiVmdenKgvxqZb2pw8EaAxUWQyV+VDCAiEwb:nFkf1sPe8GWM3KgJOb2pwVxrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 13f4da72220ae55b49a4e2fb2928a7830ac79a0b81704f5834739aa8d2107307
- MD5 91ff477ee54aef287c32127b7e1ae397
- SHA1 911034df05847a9822e597034c4feb06eff58c59
- SHA512 986cbfc0ef8febea15a17714196e59d6a29f4d06f1f453b3d85a75bd1a5e6948a1725e5912620c1b2e77057d3560093237557c9e6c2f1ff9bf2067a1770a5454
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupVMke2RUIJ+kW3z2OMDCRHp:A9iIxuERzA83h09RZxYZzWaOMWRHqlWX
- MD5 SHA1 SHA512 SSDEEP