Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 09:28
Static task
static1
Behavioral task
behavioral1
Sample
9148c3d82fa5f1aee3b9f7fc80c105ab_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
9148c3d82fa5f1aee3b9f7fc80c105ab_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 9148c3d82fa5f1aee3b9f7fc80c105ab_JaffaCakes118.html
- Size 18KB
- Sample240603-lfnweabc98
- SHA256 618e4a3f25a5539cedd5c7bc8b5810a5e5b646638a30ebe84501df17cdc5a43d
- MD5 9148c3d82fa5f1aee3b9f7fc80c105ab
- SHA1 c0b0ee1a94ba5d60c53fc91c9b991ae70aee1170
- SHA512 0c93fcb81fd37f1caad90058bcd2edb3567a11340273ad006fceb9ed4a44447d918ab64d00365a2d8b8e510eef895750b1c9babf39bfc4eed6f505d29c0e87d0
- SSDEEP 192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIX4zzUnjBh9H82qDB8:SIMd0I5nO9HBsv9cxDB8
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1556 msedge.exe 1556 msedge.exe 3452 msedge.exe 3452 msedge.exe 1252 msedge.exe 1252 msedge.exe 1252 msedge.exe 1252 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3452 msedge.exe 3452 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3452 wrote to memory of 4596 3452 msedge.exe 82 PID 3452 wrote to memory of 4596 3452 msedge.exe 82 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 4832 3452 msedge.exe 83 PID 3452 wrote to memory of 1556 3452 msedge.exe 84 PID 3452 wrote to memory of 1556 3452 msedge.exe 84 PID 3452 wrote to memory of 4712 3452 msedge.exe 85 PID 3452 wrote to memory of 4712 3452 msedge.exe 85 PID 3452 wrote to memory of 4712 3452 msedge.exe 85 PID 3452 wrote to memory of 4712 3452 msedge.exe 85 PID 3452 wrote to memory of 4712 3452 msedge.exe 85 PID 3452 wrote to memory of 4712 3452 msedge.exe 85 PID 3452 wrote to memory of 4712 3452 msedge.exe 85 PID 3452 wrote to memory of 4712 3452 msedge.exe 85 PID 3452 wrote to memory of 4712 3452 msedge.exe 85 PID 3452 wrote to memory of 4712 3452 msedge.exe 85 PID 3452 wrote to memory of 4712 3452 msedge.exe 85 PID 3452 wrote to memory of 4712 3452 msedge.exe 85 PID 3452 wrote to memory of 4712 3452 msedge.exe 85 PID 3452 wrote to memory of 4712 3452 msedge.exe 85 PID 3452 wrote to memory of 4712 3452 msedge.exe 85 PID 3452 wrote to memory of 4712 3452 msedge.exe 85 PID 3452 wrote to memory of 4712 3452 msedge.exe 85 PID 3452 wrote to memory of 4712 3452 msedge.exe 85 PID 3452 wrote to memory of 4712 3452 msedge.exe 85 PID 3452 wrote to memory of 4712 3452 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9148c3d82fa5f1aee3b9f7fc80c105ab_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa31f646f8,0x7ffa31f64708,0x7ffa31f647182⤵PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,5377804384011039962,7806078421072517925,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:22⤵PID:4832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,5377804384011039962,7806078421072517925,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,5377804384011039962,7806078421072517925,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:82⤵PID:4712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5377804384011039962,7806078421072517925,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:1576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5377804384011039962,7806078421072517925,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,5377804384011039962,7806078421072517925,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4920 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1252
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3032
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
- MD5 ae54e9db2e89f2c54da8cc0bfcbd26bd
- SHA1 a88af6c673609ecbc51a1a60dfbc8577830d2b5d
- SHA512 e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
- MD5 f53207a5ca2ef5c7e976cbb3cb26d870
- SHA1 49a8cc44f53da77bb3dfb36fc7676ed54675db43
- SHA512 be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1ba5d7ae-7406-4408-a8a5-29e7bc4b247d.tmp
- Size 5KB
- SHA256 fbf5ed2b4886327c0424be84f39913ff164fe8e6b2646888ec7491cb90464fec
- MD5 2345bb7f4dd026dbb6ff3710bc475d5a
- SHA1 bef5bd89d37450340cc2a592dad528915e2517b5
- SHA512 31a9edbdc400e347585a40206795c501b4508d9cf4ed18535dbd06805464737702e6c64214d04447f6b408cd2432e3b87982be61f2ea3eeac3659e8cdb2d9380
- SSDEEP 96:nq2kM6m1kkPe8wpvWMoiVmdeHpw8ELARUWQyV+VDCziEwb:nq2kbmOkPe8GWMXpwuRro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6e7e91c9-8d26-4746-951d-503c2199bb67.tmp
- Size 6KB
- SHA256 2aa51226b2cebba52ee756562835db76c3475a14b63e59363f0b7ea46544fa71
- MD5 0e9302311f99227676fb63c769994cb0
- SHA1 d048b87a5e4ce7644ea070e20b3f5c2eb40c0f1f
- SHA512 a9d15a8323ad5f3b2a8dee8b17f2633cccfa3578c0b8b2c6b8c5baa3bae401d0a81e2ad962196c4281dc7a52e9eb74bcd57785342e274fdeab43bb653a70cee7
- SSDEEP 96:nq2k36m1kkPe8wpvWMoiVmdeHpw8ELARUWQyV+VDCAiEwb:nq2kqmOkPe8GWMXpwuRrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 6f2556e99abe53c296c5f45bf2298b63fc33b856cb4c440cc49acfdac105641f
- MD5 5d9c02fbdd778d8d1dda76f728883b54
- SHA1 10115e5978a58eb487f59602cc3891da9ed4dfb1
- SHA512 4f77ad8f032748b84f575ce90ad86cb17885789c4c70713599c955fb9fb083d09da49abfda52bfaaa776413ece50a1ea0ca356a7695b9bf09dfaec73f53b6659
- SSDEEP 96:nq2k36m1kk8e8wpvWMoiVmdeHpw8ELARUWQyV+VDCAiEwb:nq2kqmOk8e8GWMXpwuRrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 c141716c9c0da24e51ec787c1459dea99aa4f1e422837487053c820768ccb409
- MD5 8b0ad04fcba2b5cdf1e0fd8ed29d1792
- SHA1 fed7ff6be343f1f70ec2a0bef0076c5fbaaa31ae
- SHA512 3995fcbb84d8dd9319571eaa5341459fc21ceab07d229431103b65fd5b0bf4dc4211f9c5e23b59a50802869e439a124aeaa0bce6e85351f1e11bfdc747dab7b6
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupzMse2RUkl/J+kQ3z2OMDCU:A9iIxuERzA83h09RZxYfvxQaOMWRHqll
- MD5 SHA1 SHA512 SSDEEP