Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 23:24
Static task
static1
Behavioral task
behavioral1
Sample
92f7324398c50fd86b264c6a5176937e_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
92f7324398c50fd86b264c6a5176937e_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 92f7324398c50fd86b264c6a5176937e_JaffaCakes118.html
- Size 135KB
- Sample240603-3dvplsdg34
- SHA256 3fc952c348929125a7665725d103edbe55bab9118d5204defb825f4c5f05f566
- MD5 92f7324398c50fd86b264c6a5176937e
- SHA1 ecc4707c0c14ba0e6f5312d63f0cf4bc1d1d2b49
- SHA512 25256da42effcb0f42ffa622d5aa9c4946ac633a8d01f623946adb81b9ad33a5f4b5af7f533ef293ed23fab58835ec6d3690e4605395c253275374f2ca6a3440
- SSDEEP 1536:SYyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsQX:SYyfkMY+BES09JXAnyrZalI+Y76IMA
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4224 msedge.exe 4224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2224 msedge.exe 2224 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2224 wrote to memory of 116 2224 msedge.exe 81 PID 2224 wrote to memory of 116 2224 msedge.exe 81 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 1652 2224 msedge.exe 82 PID 2224 wrote to memory of 4224 2224 msedge.exe 83 PID 2224 wrote to memory of 4224 2224 msedge.exe 83 PID 2224 wrote to memory of 4148 2224 msedge.exe 84 PID 2224 wrote to memory of 4148 2224 msedge.exe 84 PID 2224 wrote to memory of 4148 2224 msedge.exe 84 PID 2224 wrote to memory of 4148 2224 msedge.exe 84 PID 2224 wrote to memory of 4148 2224 msedge.exe 84 PID 2224 wrote to memory of 4148 2224 msedge.exe 84 PID 2224 wrote to memory of 4148 2224 msedge.exe 84 PID 2224 wrote to memory of 4148 2224 msedge.exe 84 PID 2224 wrote to memory of 4148 2224 msedge.exe 84 PID 2224 wrote to memory of 4148 2224 msedge.exe 84 PID 2224 wrote to memory of 4148 2224 msedge.exe 84 PID 2224 wrote to memory of 4148 2224 msedge.exe 84 PID 2224 wrote to memory of 4148 2224 msedge.exe 84 PID 2224 wrote to memory of 4148 2224 msedge.exe 84 PID 2224 wrote to memory of 4148 2224 msedge.exe 84 PID 2224 wrote to memory of 4148 2224 msedge.exe 84 PID 2224 wrote to memory of 4148 2224 msedge.exe 84 PID 2224 wrote to memory of 4148 2224 msedge.exe 84 PID 2224 wrote to memory of 4148 2224 msedge.exe 84 PID 2224 wrote to memory of 4148 2224 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\92f7324398c50fd86b264c6a5176937e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcefba46f8,0x7ffcefba4708,0x7ffcefba47182⤵PID:116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,14302384209343051692,1850583917614124117,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:1652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,14302384209343051692,1850583917614124117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,14302384209343051692,1850583917614124117,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:82⤵PID:4148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14302384209343051692,1850583917614124117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:2604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14302384209343051692,1850583917614124117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:1960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,14302384209343051692,1850583917614124117,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2628
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1488
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
- MD5 1ac52e2503cc26baee4322f02f5b8d9c
- SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
- SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
- MD5 b2a1398f937474c51a48b347387ee36a
- SHA1 922a8567f09e68a04233e84e5919043034635949
- SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 b012f629e50c594b0af97ca4cd272d8486bab2f3ce14b5ca7a78d0e916336809
- MD5 fab6704c84e65afb5f194b40a5e1cf3f
- SHA1 67610bf241f1335aa606daf9e8e191198f465356
- SHA512 1689a8608894df5d3e317ab8b4f46654e12098a226e3121cc223e8bd9179fc1172ac1a079d13be29bf791b9df020c56118e6ec4edc1ce22260ba0b5a92bb6042
- SSDEEP 96:nglkow819qga9IQwpvWMoiVmdeHpCrubcUWQyV+VDCziEwb:nglkX875aCQGWMXppbcro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 071ede91fc2cf891e049a54d836906152af1de1fff806fe0c448b51cb5541645
- MD5 cfe3b994e836df4c7bc430d30bec991e
- SHA1 ae9f9c1d7854a32cc131458dc96045a6578374a8
- SHA512 27006e96079cfd1b47a1068f768be056178d2018d8447dc6e51a1c1d6e54b3689b17e4fa586837ea77dd5caf73ad85de609ccd577b1f0b3f6b5edba6f3058846
- SSDEEP 96:nglkDw819qga9IQwpvWMoiVmde/qpCrubcUWQyV+VDCAiEwb:nglkk875aCQGWMPqppbcrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 4f3ca1e3061e7a8681e797a1fc8b05e1bb511a78eb869fa3d67e86a91274717b
- MD5 3cb2228c948f39a418e641f8f4567519
- SHA1 50a8a41462e7fd3984111a98458a9875363858ab
- SHA512 8e3646af5a98f4949829f11c20ae112ce891e456d20fa21d2b13ac545b9282146d8fb27c162616656455ba7a41db391e2bda577df3d2536e5f1f82bf55cf7f66
- SSDEEP 96:nglkDw819bga9IQwpvWMoiVmde/qpCrubcUWQyV+VDCAiEwb:nglkk870aCQGWMPqppbcrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 cfd308c468b2e8290d11a45a3316ddeed82d38a30638f2b63f77fbba3652f7a1
- MD5 c42cb9af5bdb289ed55b7667996e0d7a
- SHA1 beb746bba963cdc1ee184dde3e5d537be7b9466b
- SHA512 04e54b284a6acf8065e29067f6ace786d29b2c76413a0e7c2e320fa6f6cc3e06d53523dfe7aac9c78d07d9933f0fe42197919947d4ed5cbb00d4da9f8d64ad94
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupWkCe2RUJjf7ZZ3z2OMDCRA:A9iIxuERzA83h09RZxYWk8czZZaOMWRA
- MD5 SHA1 SHA512 SSDEEP