Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 07:35
Static task
static1
Behavioral task
behavioral1
Sample
90f899b012750373d478d12253f4a091_JaffaCakes118.html
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
90f899b012750373d478d12253f4a091_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 90f899b012750373d478d12253f4a091_JaffaCakes118.html
- Size 17KB
- Sample240603-jetzxshd65
- SHA256 1cc25e8ab2596676952cb30018541525a541b01cbe84b8b574147f7fd5ec33a3
- MD5 90f899b012750373d478d12253f4a091
- SHA1 387c9bd7dce98380668cd98c6c8045decb526334
- SHA512 1e28fb077830fb02d38b98a73a06ebb7c83d686497472a8c1650c8ef5c6ee1deb24cc8c5c8f2f4e2034596507ab89f616301ce5d2f45d5eb0cf1f8d01eaa842f
- SSDEEP 192:SIM3t0I5fo9cKivXQWxZxdkVSoAId4DzUnjBhVv82qDB8:SIMd0I5nvH1svV0xDB8
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4348 msedge.exe 4348 msedge.exe 4480 msedge.exe 4480 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4480 msedge.exe 4480 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe 4480 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4480 wrote to memory of 2656 4480 msedge.exe 83 PID 4480 wrote to memory of 2656 4480 msedge.exe 83 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 1576 4480 msedge.exe 84 PID 4480 wrote to memory of 4348 4480 msedge.exe 85 PID 4480 wrote to memory of 4348 4480 msedge.exe 85 PID 4480 wrote to memory of 8 4480 msedge.exe 86 PID 4480 wrote to memory of 8 4480 msedge.exe 86 PID 4480 wrote to memory of 8 4480 msedge.exe 86 PID 4480 wrote to memory of 8 4480 msedge.exe 86 PID 4480 wrote to memory of 8 4480 msedge.exe 86 PID 4480 wrote to memory of 8 4480 msedge.exe 86 PID 4480 wrote to memory of 8 4480 msedge.exe 86 PID 4480 wrote to memory of 8 4480 msedge.exe 86 PID 4480 wrote to memory of 8 4480 msedge.exe 86 PID 4480 wrote to memory of 8 4480 msedge.exe 86 PID 4480 wrote to memory of 8 4480 msedge.exe 86 PID 4480 wrote to memory of 8 4480 msedge.exe 86 PID 4480 wrote to memory of 8 4480 msedge.exe 86 PID 4480 wrote to memory of 8 4480 msedge.exe 86 PID 4480 wrote to memory of 8 4480 msedge.exe 86 PID 4480 wrote to memory of 8 4480 msedge.exe 86 PID 4480 wrote to memory of 8 4480 msedge.exe 86 PID 4480 wrote to memory of 8 4480 msedge.exe 86 PID 4480 wrote to memory of 8 4480 msedge.exe 86 PID 4480 wrote to memory of 8 4480 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\90f899b012750373d478d12253f4a091_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3fa246f8,0x7ffd3fa24708,0x7ffd3fa247182⤵PID:2656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,946000073572331628,15103143642981595523,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:1576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,946000073572331628,15103143642981595523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,946000073572331628,15103143642981595523,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:82⤵PID:8
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,946000073572331628,15103143642981595523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,946000073572331628,15103143642981595523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,946000073572331628,15103143642981595523,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4628
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2660
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
- MD5 ae54e9db2e89f2c54da8cc0bfcbd26bd
- SHA1 a88af6c673609ecbc51a1a60dfbc8577830d2b5d
- SHA512 e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
- MD5 f53207a5ca2ef5c7e976cbb3cb26d870
- SHA1 49a8cc44f53da77bb3dfb36fc7676ed54675db43
- SHA512 be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 a8e0120bb1c5f90e962a14aa30e7b01ce387525257739a31d12f8d3221dd7ef3
- MD5 270b6db455093d5843c53a0e82ff9b66
- SHA1 1bc1ed4ad179d4b3fa1a83619cbc435a30eaacc0
- SHA512 de74d870963b1f44ec507adb22179ddaf5591803394e80b0c07b78c271506f41406c0f7dd38bfafe0d54a483ea248483673f51f9c58217bb586c1e1715ef0cd8
- SSDEEP 96:nNkOgY1ILe8wpvWMoiVmdeHpw8E/Ai+UWQyV+VDCziEwb:nNk0yLe8GWMXpw+i+ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 a88dfd302fb7a9adde0b19f24cc4825660ad23d7cef422f65d7b592c05746faa
- MD5 41bd46035d0c6237e4ff2bb9a3c59417
- SHA1 d212eb86a8df7693985694183aabdf4c456823a1
- SHA512 960452b811836f3a0c67226c527c80253a6f8a6290a48ab9ea49f17e0b4ef4fecf26a0f7f64c9c2d50434a8c21e39d23b3c58be33c18abfaa973ffefa8ab7421
- SSDEEP 96:nNkFgY1ILe8wpvWMoiVmdeHpw8E/Ai+UWQyV+VDCAiEwb:nNk9yLe8GWMXpw+i+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 6b3d7ed502a8acac2ff6b9e0ba957a496983ae4e285274bdb71be5372dea7c87
- MD5 d39692757d92ff3ad86538a9044697c1
- SHA1 86701ac4b9cb6647be508552300d45477b545b6e
- SHA512 d3ef5316a08f97227a78d3d3acde88aa4db5a5e94ba84a7560aae846a18acb9a6274aabfc03db237ef8a024e0df3050c82be7c3ec6e9083a5cd597db59d742ae
- SSDEEP 96:nNkFgY1I4e8wpvWMoiVmdeHpw8E/Ai+UWQyV+VDCAiEwb:nNk9y4e8GWMXpw+i+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 8965d7a18d76f0aff4c8d92b86145d1229f2042c0477c75ab726c6eb21100f75
- MD5 a56ff90db5840a2a821b696d095017d6
- SHA1 44bbf4191213e0bc1a2b1c81b2275c5793960534
- SHA512 363d80a1e4a5fc54244e7a0e7d6cc3023f3e9d047f7113b47de9b070fabcfadd1ec2f6a2ba94e78b4005a45db32259bcb481b1ecfb5f326ae26ede5540120344
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupkMbe2RU/J+k73z2OMDCRHt:A9iIxuERzA83h09RZxY307aOMWRHqlWn
- MD5 SHA1 SHA512 SSDEEP