Analysis
- max time kernel
147s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 06:49
Static task
static1
Behavioral task
behavioral1
Sample
8d35e441ef0739489073f0ebf0007aa4_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
8d35e441ef0739489073f0ebf0007aa4_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 8d35e441ef0739489073f0ebf0007aa4_JaffaCakes118.html
- Size 91KB
- Sample240602-hlg39sef89
- SHA256 088e38375659d6bdd632e242552e61ed8394be4c2ca4a702f931521ff04a060c
- MD5 8d35e441ef0739489073f0ebf0007aa4
- SHA1 078b7ef62e242517b85d8db01a934cf56dbb9fbf
- SHA512 1e575ada0943156842e539c3ca66d573129d8a3a882497fa99eaa50604c513a47b06e8f69cc3799186079b2c04e3cb17475215fc54c6dd83e443f36716c73885
- SSDEEP 1536:3FtSW9k9ClgvfUHsJhVjnsPY08Y2p74P4GmDJdhWgThVXNerStPM:3FAWXA1jnQYTpRDJdYgThDerStPM
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2428 msedge.exe 2428 msedge.exe 3964 msedge.exe 3964 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe 3964 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3964 wrote to memory of 1124 3964 msedge.exe 81 PID 3964 wrote to memory of 1124 3964 msedge.exe 81 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 1176 3964 msedge.exe 82 PID 3964 wrote to memory of 2428 3964 msedge.exe 83 PID 3964 wrote to memory of 2428 3964 msedge.exe 83 PID 3964 wrote to memory of 3076 3964 msedge.exe 84 PID 3964 wrote to memory of 3076 3964 msedge.exe 84 PID 3964 wrote to memory of 3076 3964 msedge.exe 84 PID 3964 wrote to memory of 3076 3964 msedge.exe 84 PID 3964 wrote to memory of 3076 3964 msedge.exe 84 PID 3964 wrote to memory of 3076 3964 msedge.exe 84 PID 3964 wrote to memory of 3076 3964 msedge.exe 84 PID 3964 wrote to memory of 3076 3964 msedge.exe 84 PID 3964 wrote to memory of 3076 3964 msedge.exe 84 PID 3964 wrote to memory of 3076 3964 msedge.exe 84 PID 3964 wrote to memory of 3076 3964 msedge.exe 84 PID 3964 wrote to memory of 3076 3964 msedge.exe 84 PID 3964 wrote to memory of 3076 3964 msedge.exe 84 PID 3964 wrote to memory of 3076 3964 msedge.exe 84 PID 3964 wrote to memory of 3076 3964 msedge.exe 84 PID 3964 wrote to memory of 3076 3964 msedge.exe 84 PID 3964 wrote to memory of 3076 3964 msedge.exe 84 PID 3964 wrote to memory of 3076 3964 msedge.exe 84 PID 3964 wrote to memory of 3076 3964 msedge.exe 84 PID 3964 wrote to memory of 3076 3964 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8d35e441ef0739489073f0ebf0007aa4_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c0a746f8,0x7ff8c0a74708,0x7ff8c0a747182⤵PID:1124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3918489944646778712,8194835877598494766,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:1176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,3918489944646778712,8194835877598494766,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,3918489944646778712,8194835877598494766,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:82⤵PID:3076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3918489944646778712,8194835877598494766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3918489944646778712,8194835877598494766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:1372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3918489944646778712,8194835877598494766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3020 /prefetch:12⤵PID:4476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3918489944646778712,8194835877598494766,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5848 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3918489944646778712,8194835877598494766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:12⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3918489944646778712,8194835877598494766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:12⤵PID:1632
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3040
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:112
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
- MD5 56641592f6e69f5f5fb06f2319384490
- SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
- SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
- MD5 612a6c4247ef652299b376221c984213
- SHA1 d306f3b16bde39708aa862aee372345feb559750
- SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
- Size 23KB
- SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
- MD5 e1c71f7c04be834f5587230db2ad24b3
- SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
- SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51
- SSDEEP 384:LrvAH+TKO2Dci+FlkjrkWOKJepIhTZ47jmxKbHsc4VzhGKTdHn5Y0MlJacX9oybk:feIhQcf4fkrTpidOdjz4jGAdH6vPao3Y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 96B
- SHA256 148a3ae541210f7f09c5be7d6fbf40f27884f47823ba7e994dbc96806e563612
- MD5 038a67e65f9280fa6ad8dda251af1c84
- SHA1 5766a16501bada0b2f0590a2b79fb890b8ab1673
- SHA512 9e1199d7ee12f7f2cd957e1870710395ab704a490d256700bb1790d1293a8ccc00af356a0eb4ee03052bf6ece1326769b517558591bc6f177fe7fb4eaf901ac5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 789B
- SHA256 35a1855b617549d12dd96b421a3258b39a4e40600dd9296c3a9268e84703d30e
- MD5 fc8642b785bf57368f086408a657adfe
- SHA1 46419c16a19cede8feda60dee3354ae484ebc745
- SHA512 4eb6ef502ceede58f9d8c9a95db80b0cdb84baabeb2b59b20653e684f63e477abbc7582d2ac16cf600e93c40528f48ccf8fb0a1d58c9259a9fe36e000d92c6dd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 ff8ef7d82337b1da1231cf04ee24e43af5ee3b540eeb036d9c73da16fe80bdb3
- MD5 f5fa65860cbbfd7f6358e4b33775ae64
- SHA1 9f9f28972c42f98eff65413dfb850c4a7903b9d5
- SHA512 14ea4e5d045d8acecd53230fcd523c7113a6440e65108039a6b65f3fe2a05658dd05fe9454a46325dbf4d40f99e0e41a67ef3b17c75337b77e5a5e87e18089e1
- SSDEEP 96:nZkZm1NP2wpvWMoiVmdeHk4ZUWQyV+VDCziEwb:nZkgzP2GWMXHro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 7KB
- SHA256 f3d6ff628c600dd2855968f78c14744caa1ba5d8e6f60a74f29f211c2e512348
- MD5 539dbf120510a0762cc9945365cf19b5
- SHA1 a5c103a6a609ce56baedfe77b3a91fcaa5df5de2
- SHA512 cf2f599f219165bfacdf2f1e997388b6f179a0e2bbaaeab09fbd55a0ea05987ea416bb5655245e21f711e446433e798db563d3a7b397a6f51aebd3722eccb5ab
- SSDEEP 96:nZkkm1N92wpvWMoiVmdeM4jMUnan31O22kTZUWQyV+VDCAiEwb:nZkDz92GWMc4jMUna31O22GrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 a2aef3033608a32b92afda94e61d0992e511951549b41c55ba3a249686a16521
- MD5 1b67117192c2f15981c5891adfd1651e
- SHA1 b2a8aea3c97d5a1ac4ff309b2be82cac8655e789
- SHA512 9835a1ab838f3397e7063a6c0f6b62d13023bae453863aa65003faba32d84862ffbb07b52b86ef7f3e7d1f6426dd15655ca577e3c60eb6310ad400ce31719830
- SSDEEP 96:nZkkm1NP2wpvWMoiVmdej22k4ZUWQyV+VDCAiEwb:nZkDzP2GWMz22HrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
- Size 705B
- SHA256 1a1090ec27932b65179f8b22ed2be27da6922a408e6da0aa59c9b36b19b80899
- MD5 63cf3a71fb9ee340b30cdf30b2c37711
- SHA1 8fcf3dcbec043ddaaf0d22e753468689e285e385
- SHA512 f897b37480971b210757bb6ca2383d4cf52f1ec7e19efc6355f6d6a8f22957015b059560a909847b4d6f5a372db231899601df73ad8a6e7a338bacbb5d1facdb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59748a.TMP
- Size 370B
- SHA256 61cfcc0713e053a58505fc7861aa503faf9c119dba661cd7984782d4b5f19351
- MD5 637f74b709e3f8b5fa06f4b0828af72a
- SHA1 6f8bb3c162bdf1988998c0bc857a602d517744fe
- SHA512 691ed6dcb1464524933a080e7f6c1a7cc7a23a3f341d36d52844135967a1f590471c7c2cc5eb168beab5cdd965c1066abe685f7cafd5d5bfc0d80daf0016ea68
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 eebd3c41229a14337e3ccec2b6d4f50f663a0ddcd5239eaaf56f87ca36b40e8c
- MD5 588a1269c88d0651c6c891776ea01432
- SHA1 6f5f76d82c86b33557c647c88a1a6862376ee99f
- SHA512 219c2215be6ac1bd00357d66f743617b2e5c6d361b17a62bf5e1f3caa72151e3631472b0333792e99b123e15ed97c15868ca6c2e3e99134ead84aaae5ebb0c39
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphHTe2RUoyRVv3z2OMDCRH3:A9iIxuERzA83h09RZxYVD0vaOMWRHql2
- MD5 SHA1 SHA512 SSDEEP