Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 08:32
Static task
static1
Behavioral task
behavioral1
Sample
9122c8e8d31e489d0395dbd3e6387041_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
9122c8e8d31e489d0395dbd3e6387041_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 9122c8e8d31e489d0395dbd3e6387041_JaffaCakes118.html
- Size 186KB
- Sample240603-kfp8ssae27
- SHA256 aff1be13abbfef72e69bbd4d759234cac34b3773ca743b9ad24371bf2d9bdb87
- MD5 9122c8e8d31e489d0395dbd3e6387041
- SHA1 a803831e45cef0daedd4ac9484d9a7ca356d47f3
- SHA512 580d99f6fdc375bf5e3680ddd973fe519115448c52cf7739fd331f0b2e6b1018ddfedec896562b4ae49f3a67e37cae40e23a3e67f10580b5bf3dde12c1874d59
- SSDEEP 3072:JudmQFjZnanSBFunwEaX2GZ2UToW8S+9F5oJnAhd:qmQMC2yY
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3180 msedge.exe 3180 msedge.exe 4028 msedge.exe 4028 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4028 wrote to memory of 2272 4028 msedge.exe 82 PID 4028 wrote to memory of 2272 4028 msedge.exe 82 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3440 4028 msedge.exe 83 PID 4028 wrote to memory of 3180 4028 msedge.exe 84 PID 4028 wrote to memory of 3180 4028 msedge.exe 84 PID 4028 wrote to memory of 1560 4028 msedge.exe 85 PID 4028 wrote to memory of 1560 4028 msedge.exe 85 PID 4028 wrote to memory of 1560 4028 msedge.exe 85 PID 4028 wrote to memory of 1560 4028 msedge.exe 85 PID 4028 wrote to memory of 1560 4028 msedge.exe 85 PID 4028 wrote to memory of 1560 4028 msedge.exe 85 PID 4028 wrote to memory of 1560 4028 msedge.exe 85 PID 4028 wrote to memory of 1560 4028 msedge.exe 85 PID 4028 wrote to memory of 1560 4028 msedge.exe 85 PID 4028 wrote to memory of 1560 4028 msedge.exe 85 PID 4028 wrote to memory of 1560 4028 msedge.exe 85 PID 4028 wrote to memory of 1560 4028 msedge.exe 85 PID 4028 wrote to memory of 1560 4028 msedge.exe 85 PID 4028 wrote to memory of 1560 4028 msedge.exe 85 PID 4028 wrote to memory of 1560 4028 msedge.exe 85 PID 4028 wrote to memory of 1560 4028 msedge.exe 85 PID 4028 wrote to memory of 1560 4028 msedge.exe 85 PID 4028 wrote to memory of 1560 4028 msedge.exe 85 PID 4028 wrote to memory of 1560 4028 msedge.exe 85 PID 4028 wrote to memory of 1560 4028 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9122c8e8d31e489d0395dbd3e6387041_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa37e46f8,0x7ffaa37e4708,0x7ffaa37e47182⤵PID:2272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4488990563105139396,17121481786317181829,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵PID:3440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,4488990563105139396,17121481786317181829,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,4488990563105139396,17121481786317181829,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:82⤵PID:1560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4488990563105139396,17121481786317181829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4488990563105139396,17121481786317181829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4488990563105139396,17121481786317181829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:12⤵PID:2124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4488990563105139396,17121481786317181829,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2376 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4440
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4932
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
- MD5 a8e767fd33edd97d306efb6905f93252
- SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
- SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
- MD5 439b5e04ca18c7fb02cf406e6eb24167
- SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
- SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1b70e61a-4eb4-4bf3-8257-82155eb8627b.tmp
- Size 5KB
- SHA256 b83967f8c10c0261f2db883a5387a315a8c91e7f801186603e7257027b8124a4
- MD5 3a98b71ba63d592c7fcc02ff9d62b134
- SHA1 6b34ab794019f052f0ccc024f093f7d6f92dbd32
- SHA512 5d879f853016f3f443f9a4ebca513e49825f2c92661ec560fce26da091ea0be4a91b2679979e2e2e5df5e59aba26600a26789f05e48d1d58f292ef43ecdb9c11
- SSDEEP 96:nLkxM1gEJamwpvWMoiVmdeHBrzvUWQyV+VDCziEwb:nLkq5JamGWMXVro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 96B
- SHA256 6617648524dc5bf57faabc9772e0c7f7e8f02343256acb781a84a837da873b14
- MD5 4cdf2e53d364f0e990b09f666c47815a
- SHA1 0a44229cb100c9e3a37153790fa1e9ed8dd8ffbb
- SHA512 af3b04e16e9d845bd52f4f336b6de6890512cdd82cad83f10ec21abec329aac4fa14e103a3d1e6fcfeddc2ab6dee0a49b8e7257544a4476b1f586640449ab7fb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 1KB
- SHA256 fa6771ca703874bcd9c6e092db25850f5ec63f937da91cd356bf58669246f7ad
- MD5 9ec6a7765a0383874dda84f76a9b1daf
- SHA1 446efcf203f40aa0cc0208e536e5473bf2d40be7
- SHA512 fd3578bb01fd92d5d4f4f4fba981c47376d332870b74fc744de533a5d286367ca7009fefd88533e4b22f20e133e7fb3e0ce09a4455d0cf0d37b577943759a002
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 632ca09b3aee597c3f9be64cc7945bfd97c5414fb2428d1c3630eb6b7bb6e5df
- MD5 3a52dede29af43a881ffc44775d3a8f9
- SHA1 1ae2010f79c4f45f930938bf7ec970d15ce734ce
- SHA512 dbe14462749d0ebaf9d0987185e0fab09410d287fc24e93466658f5909316bd0f1a01977b29e9f9f2aca450943ad68ed77055ad22993b4caf9678816d0d66e4e
- SSDEEP 96:nLkcM1gEJamwpvWMoiVmdeEXTD6W3p2BrzvUWQyV+VDCAiEwb:nLkB5JamGWMYTD6W3p2VrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 f25805c0f521a4607dc154786157093914eaedf57b76aa40726ec3227dda6fc9
- MD5 c2dffc771fc05d6c931a8369a84ee2ea
- SHA1 0e929f58f4da29b681b12a8244273c810e341ae5
- SHA512 5b0e7f98dd9681a298bc2e01ed5432c1afd19cbfdeb5e48a30596572b8b25fe4e67d423d44802038ba1b43d5304a116bf1da6c3c5d73b0da0916183f00098f12
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRH8e2RU+hMj2X3z2OMDCR4:A9iIxuERzA83h09RZxYRHinqyXaOMWR4
- MD5 SHA1 SHA512 SSDEEP