Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 07:51
Static task
static1
Behavioral task
behavioral1
Sample
8d5c3522654e11cdeee907ecdc45f68d_JaffaCakes118.html
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
8d5c3522654e11cdeee907ecdc45f68d_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 8d5c3522654e11cdeee907ecdc45f68d_JaffaCakes118.html
- Size 154KB
- Sample240602-jp2shsfc9z
- SHA256 189e63220e18ffd90bb24639d938f85e1212f349f0e53bb21efcd1994fdea22e
- MD5 8d5c3522654e11cdeee907ecdc45f68d
- SHA1 513ead29e1dfbeb7d6e3932e4c5e51f57b566c71
- SHA512 4157da40e45d57e2a4b85e3bf9f159e72076eb362bf8f8c4d35f323f1fe9a2cdd1cf1dc101c13902395c3552eeebe6318e45a2019b1ca6de4da46a2a03819613
- SSDEEP 3072:8eeCZAV2ygDWiLlDssFhvqS231HiGjora+9sd:bZdPssFU
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3520 msedge.exe 3520 msedge.exe 528 msedge.exe 528 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 528 msedge.exe 528 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe 528 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 528 wrote to memory of 4352 528 msedge.exe 81 PID 528 wrote to memory of 4352 528 msedge.exe 81 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3628 528 msedge.exe 82 PID 528 wrote to memory of 3520 528 msedge.exe 83 PID 528 wrote to memory of 3520 528 msedge.exe 83 PID 528 wrote to memory of 5328 528 msedge.exe 84 PID 528 wrote to memory of 5328 528 msedge.exe 84 PID 528 wrote to memory of 5328 528 msedge.exe 84 PID 528 wrote to memory of 5328 528 msedge.exe 84 PID 528 wrote to memory of 5328 528 msedge.exe 84 PID 528 wrote to memory of 5328 528 msedge.exe 84 PID 528 wrote to memory of 5328 528 msedge.exe 84 PID 528 wrote to memory of 5328 528 msedge.exe 84 PID 528 wrote to memory of 5328 528 msedge.exe 84 PID 528 wrote to memory of 5328 528 msedge.exe 84 PID 528 wrote to memory of 5328 528 msedge.exe 84 PID 528 wrote to memory of 5328 528 msedge.exe 84 PID 528 wrote to memory of 5328 528 msedge.exe 84 PID 528 wrote to memory of 5328 528 msedge.exe 84 PID 528 wrote to memory of 5328 528 msedge.exe 84 PID 528 wrote to memory of 5328 528 msedge.exe 84 PID 528 wrote to memory of 5328 528 msedge.exe 84 PID 528 wrote to memory of 5328 528 msedge.exe 84 PID 528 wrote to memory of 5328 528 msedge.exe 84 PID 528 wrote to memory of 5328 528 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8d5c3522654e11cdeee907ecdc45f68d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae23946f8,0x7ffae2394708,0x7ffae23947182⤵PID:4352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,401837289198473927,7550831249399212911,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:22⤵PID:3628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,401837289198473927,7550831249399212911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,401837289198473927,7550831249399212911,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:82⤵PID:5328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,401837289198473927,7550831249399212911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:2876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,401837289198473927,7550831249399212911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:3420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,401837289198473927,7550831249399212911,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4924
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5424
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\83dc7fae-6d07-41ad-9abb-40a99be60710.tmp
- Size 10KB
- SHA256 96ef00e733318e011d8a88f933626abc7f25b8a955d9e28e41f9c4b73bfff4ef
- MD5 dbee60e792b7817d596e930cb405bc3e
- SHA1 84863daf70845a517f1c1e4000a8f085925a1478
- SHA512 71fe3a63b6fb8bb264e3985647b5681647fbb03add10841b14ea240de66d764013a1fb03621137352de865079c34dc6ad0b769197f9c6b02d937d7e9013c87c7
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupI9e2RUjj2Zp3z2OMDCRHqr:A9iIxuERzA83h09RZxYwcKpaOMWRHqlV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
- MD5 2daa93382bba07cbc40af372d30ec576
- SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
- SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
- MD5 ecdc2754d7d2ae862272153aa9b9ca6e
- SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
- SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 602B
- SHA256 a70d18a317f48ad2af8ec8374413a4b2040ca73b84342660dbdcd4cd16a177ff
- MD5 10f6d254dd14ee095104f734c0610e7e
- SHA1 18c3ae9b7c85d47075a6fda494017a530827859a
- SHA512 5c25c3c292b1473d3d1821d9823d1b6f92bb0eae3cf56d6f3f773d93452c9bcc3eda0554daa89dedd4f801904a6fe661f277420177aa0326b6456b744d7f3359
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 e11be25caca4e667eeed94099297b0a7489793247f12e04459e3e2061ba3e32b
- MD5 2f44b65c282f304a021d5876d41df07f
- SHA1 8d87c5bf5134fad4dcacb8e9fcd87c902ee49d57
- SHA512 5b80217c86014e9ba23a2380670f7409519aca921681af121aa0a79f58957974f48ae90d866ccdd7afb9eab27d07e4ecd5675c0dbf3770a178dcb387be080d72
- SSDEEP 96:ntkFQB1O33wpvWMoiVmdeP8GtqplwBFoacW2UWQyV+VDCAiEwb:ntkaBsHGWM/fqpSoXW2rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 f208088f34362186966b89eadbdae5c69dee3269069cbff646f6c51deb88942c
- MD5 566f2243625a4c6cdedf4a6c564f1eee
- SHA1 78bd93c9d7d4f06e9a70be6b25921c3d60b4529c
- SHA512 dd7913a7034e92a58c8a205f3f67e80fe7ca2596e3abff3c170125ec0d935d34c07a54ff4a3823c068814a3ab7751665f1760353ec0d53eee018d5006855aaca
- SSDEEP 96:ntkFQB1Ov3wpvWMoiVmdeHplwtFoacW2UWQyV+VDCAiEwb:ntkaBsvGWMXpMoXW2rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 d2e5ea5d49e8d091dd36c029deac62222e3e4a1d15d9fb4850669d8fb0bd0c6c
- MD5 b599065d3c0a62a52639dd6f77af090f
- SHA1 301e9450473bae50838e00b97beed32fc95ae7ae
- SHA512 5b787416b03321a13a0cdf4e2424869a9b7183b1c212f4d17fcd91bd6a96c32495b5df34c0b9a8e55cfb748f6d3b009e41daf52dc6d4339a1afc0ce0fbefa243
- SSDEEP 96:ntkOQB1Ov3wpvWMoiVmdeHplwtFoacW2UWQyV+VDCziEwb:ntkzBsvGWMXpMoXW2ro
- MD5 SHA1 SHA512 SSDEEP