Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 22:34
Static task
static1
Behavioral task
behavioral1
Sample
8fab9d1ca5a4b7312f19baeb9cb5cc68_JaffaCakes118.html
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
8fab9d1ca5a4b7312f19baeb9cb5cc68_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 8fab9d1ca5a4b7312f19baeb9cb5cc68_JaffaCakes118.html
- Size 139KB
- Sample240602-2g543she3t
- SHA256 c822213ad4000176d7334f4e8cc9e230670ba77ea8119d23b73e5fe67185e31b
- MD5 8fab9d1ca5a4b7312f19baeb9cb5cc68
- SHA1 dfc62e031922f67f7e7c893b7b3968780e29f48c
- SHA512 fca74ee4f304bae918a8b7be389eecc83e3aa0e1831df375b5c31150ddf7c0562ff79914ce3224c53f068136661b693835ed4ebda5ef1e6f6b59891d62df8ab4
- SSDEEP 1536:SsxNji/+GlolJ6V/vhyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXAZ:SsxExyfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4944 msedge.exe 4944 msedge.exe 1856 msedge.exe 1856 msedge.exe 2056 msedge.exe 2056 msedge.exe 2056 msedge.exe 2056 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1856 msedge.exe 1856 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1856 wrote to memory of 2440 1856 msedge.exe 83 PID 1856 wrote to memory of 2440 1856 msedge.exe 83 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4380 1856 msedge.exe 84 PID 1856 wrote to memory of 4944 1856 msedge.exe 85 PID 1856 wrote to memory of 4944 1856 msedge.exe 85 PID 1856 wrote to memory of 4524 1856 msedge.exe 86 PID 1856 wrote to memory of 4524 1856 msedge.exe 86 PID 1856 wrote to memory of 4524 1856 msedge.exe 86 PID 1856 wrote to memory of 4524 1856 msedge.exe 86 PID 1856 wrote to memory of 4524 1856 msedge.exe 86 PID 1856 wrote to memory of 4524 1856 msedge.exe 86 PID 1856 wrote to memory of 4524 1856 msedge.exe 86 PID 1856 wrote to memory of 4524 1856 msedge.exe 86 PID 1856 wrote to memory of 4524 1856 msedge.exe 86 PID 1856 wrote to memory of 4524 1856 msedge.exe 86 PID 1856 wrote to memory of 4524 1856 msedge.exe 86 PID 1856 wrote to memory of 4524 1856 msedge.exe 86 PID 1856 wrote to memory of 4524 1856 msedge.exe 86 PID 1856 wrote to memory of 4524 1856 msedge.exe 86 PID 1856 wrote to memory of 4524 1856 msedge.exe 86 PID 1856 wrote to memory of 4524 1856 msedge.exe 86 PID 1856 wrote to memory of 4524 1856 msedge.exe 86 PID 1856 wrote to memory of 4524 1856 msedge.exe 86 PID 1856 wrote to memory of 4524 1856 msedge.exe 86 PID 1856 wrote to memory of 4524 1856 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8fab9d1ca5a4b7312f19baeb9cb5cc68_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1fe446f8,0x7fff1fe44708,0x7fff1fe447182⤵PID:2440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7957166714634974393,7411445125070168379,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,7957166714634974393,7411445125070168379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,7957166714634974393,7411445125070168379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:82⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7957166714634974393,7411445125070168379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7957166714634974393,7411445125070168379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:1520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7957166714634974393,7411445125070168379,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1920 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2056
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3732
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
- MD5 4b4f91fa1b362ba5341ecb2836438dea
- SHA1 9561f5aabed742404d455da735259a2c6781fa07
- SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
- MD5 eaa3db555ab5bc0cb364826204aad3f0
- SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
- SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 3c4316bfde7a6a77f445d30549489239a812660c47ca8a6eed42bad3c1429d87
- MD5 552f1da699eff7fafe1e8400e7738b1a
- SHA1 62da5dd7899d7ea05ff7fc4a4da46da6732eef19
- SHA512 0d09963fa65dcb8a1ba6437c9fef14cd3d52db097fec53bf06e293ebcd03e49423e8d77f60b5650fe4bcc78b3519dbf723015abcbacd0527a3b8e02bc1ff77a2
- SSDEEP 96:nAkR61UEj0wpvWMoiVmdeHmQIjUWQyV+VDCziEwb:nAkgaEj0GWMXsro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 dc8e92465e2e1f01356e0efe19903a8d199629d52c3a2262675c24767506d671
- MD5 008291ac9cecff180c2f9c800c926e05
- SHA1 9e3884595d3be67df6f689d6201507b2bbcdefd5
- SHA512 c76ea0ae92694f097f39e31b95bd18f4ccdf7d3d704d3fba0cc5929cb1f27d50d8509f0ca0da3005196b5b5a5eba50a869d11993275f5e3567ff0a3cdf0f62dc
- SSDEEP 96:nAk861UDj0wpvWMoiVmdeHmQIjUWQyV+VDCAiEwb:nAknaDj0GWMXsrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 3c387486981d7d929db05622ad012775d268a214fee93057c4332db67c61c5e7
- MD5 76b86a0d3761ca114dd9285df3d574a4
- SHA1 0c0b0a21af119bacd6d9f6ee6abd5dc38bf204e2
- SHA512 4b4246fda8fc7bd67e1ca7c46e707acbe1508584ca0f9c1c3ab9cf385e2cd591aa2b5e64213b0aac04b89a5104cc5298294f9b2e9b3c136d6572288e93faa058
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuppfde2RUS3IKbGXfYOxhZH5:A9iIxuERzA83h09RZxYpf55lGnxTHqTQ
- MD5 SHA1 SHA512 SSDEEP