Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 07:56
Static task
static1
Behavioral task
behavioral1
Sample
91076aed18a40fa8672dec032244364e_JaffaCakes118.html
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
91076aed18a40fa8672dec032244364e_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 91076aed18a40fa8672dec032244364e_JaffaCakes118.html
- Size 18KB
- Sample240603-js74pshg87
- SHA256 c7fc570fc41fcff59a8317c95409b4e74defb8f554a2dd9d3acc6055099994b6
- MD5 91076aed18a40fa8672dec032244364e
- SHA1 f6feb9f2043c05143927c315ee690b12693e625c
- SHA512 ee268c7db7a827b04e9154ed6357d7f6ee1fb15be3198d8e6a0d71721f77aafefaaf2d02833eeb7c44a3c90cf51a88c14f293a6ac707a452dc72c22f56edc3a6
- SSDEEP 192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI04ezUnjBhCk82qDB8:SIMd0I5nO9H3svCnxDB8
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 332 msedge.exe 332 msedge.exe 4936 msedge.exe 4936 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4936 msedge.exe 4936 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4936 wrote to memory of 2516 4936 msedge.exe 83 PID 4936 wrote to memory of 2516 4936 msedge.exe 83 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 4472 4936 msedge.exe 84 PID 4936 wrote to memory of 332 4936 msedge.exe 85 PID 4936 wrote to memory of 332 4936 msedge.exe 85 PID 4936 wrote to memory of 4752 4936 msedge.exe 86 PID 4936 wrote to memory of 4752 4936 msedge.exe 86 PID 4936 wrote to memory of 4752 4936 msedge.exe 86 PID 4936 wrote to memory of 4752 4936 msedge.exe 86 PID 4936 wrote to memory of 4752 4936 msedge.exe 86 PID 4936 wrote to memory of 4752 4936 msedge.exe 86 PID 4936 wrote to memory of 4752 4936 msedge.exe 86 PID 4936 wrote to memory of 4752 4936 msedge.exe 86 PID 4936 wrote to memory of 4752 4936 msedge.exe 86 PID 4936 wrote to memory of 4752 4936 msedge.exe 86 PID 4936 wrote to memory of 4752 4936 msedge.exe 86 PID 4936 wrote to memory of 4752 4936 msedge.exe 86 PID 4936 wrote to memory of 4752 4936 msedge.exe 86 PID 4936 wrote to memory of 4752 4936 msedge.exe 86 PID 4936 wrote to memory of 4752 4936 msedge.exe 86 PID 4936 wrote to memory of 4752 4936 msedge.exe 86 PID 4936 wrote to memory of 4752 4936 msedge.exe 86 PID 4936 wrote to memory of 4752 4936 msedge.exe 86 PID 4936 wrote to memory of 4752 4936 msedge.exe 86 PID 4936 wrote to memory of 4752 4936 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91076aed18a40fa8672dec032244364e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffd168946f8,0x7ffd16894708,0x7ffd168947182⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17663855331530317724,14321225047196079136,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:4472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,17663855331530317724,14321225047196079136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,17663855331530317724,14321225047196079136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵PID:4752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17663855331530317724,14321225047196079136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17663855331530317724,14321225047196079136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17663855331530317724,14321225047196079136,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2744 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3544
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2072
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
- MD5 56641592f6e69f5f5fb06f2319384490
- SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
- SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
- MD5 612a6c4247ef652299b376221c984213
- SHA1 d306f3b16bde39708aa862aee372345feb559750
- SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 ecda787daa6e7227a2bb08b003b25a3251aed65ff2265cb5c61debae9934ee18
- MD5 976802f2c26493d65942f67759e6a5ee
- SHA1 dcee128ec6b76dd6099f8109e6be163b548041b7
- SHA512 aa14cb8b9ecce5cea3097c150afc9e64df8c58d9e7d18584359cf34af95aa4b7ade640ff69247c73edfc14b378338223ce780780286bb6e7b53d4357d1d5a82b
- SSDEEP 96:nhkR/1R72wpvWMoiVmdeHk4kAUWQyV+VDCziEwb:nhk9b72GWMXhro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 31966b98623304750adc98c95abe2d3456dc21957d0a36edef885824d9dea2fe
- MD5 00a635b768837b40b61eaa5258cfd87e
- SHA1 ade7f23d67779ce270c84771bedc6bb48f590092
- SHA512 ff9968da22ba8fbb28a897214c256286d8ae8e6e7513ea5e75c5b43fe32d7407e19eabc468ebf1719386a00a47e4aaef06ebbf6897071d8bff5c797fa8b818e4
- SSDEEP 96:nhk8/1RK2wpvWMoiVmdeHk4kAUWQyV+VDCAiEwb:nhkGbK2GWMXhrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 4c0b011311644a3cb02947404df359d6d49de8ef6e7a735aa193c36fe2f66832
- MD5 62633f610b8629e618dce3b227a257e9
- SHA1 e88549579b6824588c2f61a2994b1dac415bc25d
- SHA512 f238dae8b3cac8477c96a33b424ba1f77bff5c75d7aeb11a1a2a7f53381db6e2ec3310e589bedae6cd433088bfccab1d19238201ec1fe2737f7572f1be803864
- SSDEEP 96:nhk8/1R72wpvWMoiVmdeHk4kAUWQyV+VDCAiEwb:nhkGb72GWMXhrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 17e8bfa3a2f994862f98d0f7afee0c1882ff5c78c31601e994cc12d02a9a97a0
- MD5 8e19b8e64f4b448483b31c32c94399ae
- SHA1 7c5e7bd6568a3bb191a9dd10ee346b087786abb2
- SHA512 d0eba04afbc5f783241e021daf4a0f072269b020d8df9a99a128d3d7df10977f86b40970cd1208c5fcaa2cf03936a91c53c009fd2f4feccf37e05b2b20625028
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupD0e2RUTy4VIM3z2OMDCRHO:A9iIxuERzA83h09RZxYGwIMaOMWRHql3
- MD5 SHA1 SHA512 SSDEEP