Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 23:09
Static task
static1
Behavioral task
behavioral1
Sample
8fc1d43fffbfbc039302c00307e3a1f2_JaffaCakes118.html
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
8fc1d43fffbfbc039302c00307e3a1f2_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 8fc1d43fffbfbc039302c00307e3a1f2_JaffaCakes118.html
- Size 139KB
- Sample240602-25f5vsae2s
- SHA256 eb608d7e24e928f728746ff1081b614048bc637054d50cd0f62370575bf96349
- MD5 8fc1d43fffbfbc039302c00307e3a1f2
- SHA1 b112d2922dfd1f5bc2e34050da2dfa70b26e5ed8
- SHA512 b408cbf5c6dc6b5b276eed1c7684e4c82f192303b49271765a3e52c140536a806f1199014887267bc91bc5b613e05335ef7e3e8ca2088a46e08ed0833c0f7ca0
- SSDEEP 3072:ScHwdwjfFyfkMY+BES09JXAnyrZalI+YQ:ScHRfwsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2904 msedge.exe 2904 msedge.exe 3480 msedge.exe 3480 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3480 msedge.exe 3480 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3480 wrote to memory of 4664 3480 msedge.exe 83 PID 3480 wrote to memory of 4664 3480 msedge.exe 83 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 4380 3480 msedge.exe 84 PID 3480 wrote to memory of 2904 3480 msedge.exe 85 PID 3480 wrote to memory of 2904 3480 msedge.exe 85 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86 PID 3480 wrote to memory of 1336 3480 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8fc1d43fffbfbc039302c00307e3a1f2_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc65f46f8,0x7ffdc65f4708,0x7ffdc65f47182⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1649739176211345051,2347322576544457112,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:22⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,1649739176211345051,2347322576544457112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,1649739176211345051,2347322576544457112,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵PID:1336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1649739176211345051,2347322576544457112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1649739176211345051,2347322576544457112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1649739176211345051,2347322576544457112,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2624
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4592
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
- MD5 ce4c898f8fc7601e2fbc252fdadb5115
- SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
- SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
- MD5 4158365912175436289496136e7912c2
- SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
- SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 fda8d106e987c536c38285d3ae257a119252ab934f446fbc99000ef976d85aad
- MD5 be4a5b31bac38c0693de9f67f7d9128e
- SHA1 c473cfb204b2cd4bed54931d05d3df7549c05f30
- SHA512 cedda9aabecea14a4208ad1c944d40224e707e6853f4d61b6373a8bbeaea2cd7b57f8e990f18cea618d5d588963d37e11e7c98685ef1b25d4fdb0e1d67c672f6
- SSDEEP 96:nYmkcok1VJaejuwpvWMoiVmdeHvSSgN9UWQyV+VDCAiEwb:n9kavJaejuGWMXeN9rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 0ff506f424f6e9e0a656cde17a2791e994049193ddaa5da1cfbc8ef8a0eaa62f
- MD5 0b07b7031b2c985a644d406576c2581d
- SHA1 3d6747fca24a7d26906122a9f29a073d1c79867a
- SHA512 48ace3302555206ecfcb324a88d7bcb295441307192761fe7ca4e5d2869c754726edbf660a4b8688e959980f4078d75d6e983bbcf9c8bb7ea148cbd8bebc3f94
- SSDEEP 96:nYmk/ok1VJaZjuwpvWMoiVmdeHvSSgN9UWQyV+VDCziEwb:n9kTvJaZjuGWMXeN9ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 295d1b3c7d21f377706e753c1a741872b2e380902eafbd3ec430f9d411b0b46d
- MD5 15a04d05c1454c083c3fa1c48ace2e29
- SHA1 a59d2ea08f078e2c9e62287595c15e15dfcb6236
- SHA512 a1c5220d7b2b758512f507243148262a432cc2b997d5757dcc92d94696a0456e221751cd3a0360d5f77eaaf73426ffd9c625637ddba56afa00e3cab05e05e747
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuplLe2RUKyRu13z2OMDCRHqZ:A9iIxuERzA83h09RZxYlbZ1aOMWRHqlf
- MD5 SHA1 SHA512 SSDEEP