Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 09:20
Static task
static1
Behavioral task
behavioral1
Sample
9142a4ed53612b4b61d7162975e726c4_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
9142a4ed53612b4b61d7162975e726c4_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 9142a4ed53612b4b61d7162975e726c4_JaffaCakes118.html
- Size 17KB
- Sample240603-lavf1aaa2s
- SHA256 cc0661b73205ee8e62d992cfa7df5bf4b3621b04a5bb5a86d8d6a59c20332bea
- MD5 9142a4ed53612b4b61d7162975e726c4
- SHA1 0c89f88d89c506d9ad1aaa54366ba46f64b76ee7
- SHA512 5ea9fb7708f2c53949f6714ef8c61e6fab6d298cbfa76fb0d8e897990e9fbe38377218f11bf691f865ad4b977c295cdd6c89473921446e0691c1668bb1ecd1da
- SSDEEP 192:SIM3t0I5fo9cKivXQWxZxdkVSoAIn4XzUnjBh9n82qDB8:SIMd0I5nvHhsv98xDB8
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2772 msedge.exe 2772 msedge.exe 2180 msedge.exe 2180 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2180 msedge.exe 2180 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe 2180 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 888 2180 msedge.exe 82 PID 2180 wrote to memory of 888 2180 msedge.exe 82 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 3052 2180 msedge.exe 83 PID 2180 wrote to memory of 2772 2180 msedge.exe 84 PID 2180 wrote to memory of 2772 2180 msedge.exe 84 PID 2180 wrote to memory of 552 2180 msedge.exe 85 PID 2180 wrote to memory of 552 2180 msedge.exe 85 PID 2180 wrote to memory of 552 2180 msedge.exe 85 PID 2180 wrote to memory of 552 2180 msedge.exe 85 PID 2180 wrote to memory of 552 2180 msedge.exe 85 PID 2180 wrote to memory of 552 2180 msedge.exe 85 PID 2180 wrote to memory of 552 2180 msedge.exe 85 PID 2180 wrote to memory of 552 2180 msedge.exe 85 PID 2180 wrote to memory of 552 2180 msedge.exe 85 PID 2180 wrote to memory of 552 2180 msedge.exe 85 PID 2180 wrote to memory of 552 2180 msedge.exe 85 PID 2180 wrote to memory of 552 2180 msedge.exe 85 PID 2180 wrote to memory of 552 2180 msedge.exe 85 PID 2180 wrote to memory of 552 2180 msedge.exe 85 PID 2180 wrote to memory of 552 2180 msedge.exe 85 PID 2180 wrote to memory of 552 2180 msedge.exe 85 PID 2180 wrote to memory of 552 2180 msedge.exe 85 PID 2180 wrote to memory of 552 2180 msedge.exe 85 PID 2180 wrote to memory of 552 2180 msedge.exe 85 PID 2180 wrote to memory of 552 2180 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9142a4ed53612b4b61d7162975e726c4_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc752146f8,0x7ffc75214708,0x7ffc752147182⤵PID:888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11213172069835724071,1552266042908664235,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:3052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,11213172069835724071,1552266042908664235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,11213172069835724071,1552266042908664235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11213172069835724071,1552266042908664235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:12⤵PID:1256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11213172069835724071,1552266042908664235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11213172069835724071,1552266042908664235,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2696 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4852
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1964
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
- MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
- SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
- SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
- MD5 87f7abeb82600e1e640b843ad50fe0a1
- SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
- SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 d5a4f9e19068ee8d78e1aa40e7f18de96db5b740c95333845fa303401b22cc65
- MD5 83b5f529cc54618fe7a6cb17a9735e8f
- SHA1 694cf7d2c6c89c02fa35fcaba6524e59e050f0e4
- SHA512 f53da644b4c05c3619c979f5ffe96eb5bfca15dff563adb57d20ad6597c6d78e66cc456565fc00055f5c2d6e790c39ee5b5cd0f4d3b8be5f9e8383bbf32a379a
- SSDEEP 96:nVkfue1W8T0wpvWMoiVmdeH/zNrEUWQyV+VDCziEwb:nVkZo8gGWMXVEro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 cff94944cf5f7df1e8796b7cf146688547b5053b5681c6455d193813107872fb
- MD5 b7e581889e726b11556cf78230a8f2ad
- SHA1 ca3df7ac2578b1ac2696bcafefc46f21e5cd484a
- SHA512 89a0f2cdf038d3958a74a7af2b0f553d8eda213193983da80e7acf72796f0cc7dea6eb8ab12c62063d922b0fd951978bab51e1603bd1264e1a4094723b6f71ac
- SSDEEP 96:nVkWue1W8q0wpvWMoiVmdeH/zNrEUWQyV+VDCAiEwb:nVkWo8ZGWMXVErV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 162419b078cf1512a046fe7bc395a7071654ab98c4f9c685e6191b44065318b2
- MD5 9d57b877927fe7c014cbc55bb2752590
- SHA1 97eb7e400d1f1a7732b75414544980e9e0479431
- SHA512 ac6b552ee78c8f5506351ffb83474a5ea3a515703f71eb9912ae06016d330743eacd9419d4156ec748f69abfe51fccf50df3c9caf09f1fdaee123684eaa4d72e
- SSDEEP 96:nVkWue1W8T0wpvWMoiVmdeH/zNrEUWQyV+VDCAiEwb:nVkWo8gGWMXVErV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 4658f4e28929d288159f0dea1f9267e68f233a63b843a09455e6be1f4aba8888
- MD5 85a20104c0b23b283b7684eb5e3a64af
- SHA1 713efd4f7d2dfe37346bd6ef0eb4b561344c094d
- SHA512 0613062ae0f66c714f43e75acc210ef64aab95bc083ac30e98eb23240ba19b1faafddc3d6b69a55261d0a83b12f7101738b8ce9f455304d748c55747025031f5
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupsv2ae2RUROmyp3z2OMDCRC:A9iIxuERzA83h09RZxYS3jpaOMWRHqln
- MD5 SHA1 SHA512 SSDEEP