Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 11:02
Static task
static1
Behavioral task
behavioral1
Sample
918a00be4601689d06a8208e61808626_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
918a00be4601689d06a8208e61808626_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 918a00be4601689d06a8208e61808626_JaffaCakes118.html
- Size 276KB
- Sample240603-m482xsde56
- SHA256 d817db33634567c201ed4dfa91d2889d5dad91352375db109c5b98ab496bf283
- MD5 918a00be4601689d06a8208e61808626
- SHA1 79a090bf4f59a8431881fcd6a42f4cccef326c91
- SHA512 7e3ec5cac9b701b5b8cea9c3eabe227f15b60bff9ce03b8c82cbf0c7ed9bfac78df2de6850b1edabf10ed59fb83575de023a827bc076bc60dea273b3adfca3fd
- SSDEEP 3072:dCb+xRcbyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:oKxRc+sMYod+X3oI+Yn86/U9jFiM
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2260 msedge.exe 2260 msedge.exe 3244 msedge.exe 3244 msedge.exe 2568 msedge.exe 2568 msedge.exe 2568 msedge.exe 2568 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3244 msedge.exe 3244 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe 3244 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3244 wrote to memory of 4444 3244 msedge.exe 82 PID 3244 wrote to memory of 4444 3244 msedge.exe 82 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 3552 3244 msedge.exe 83 PID 3244 wrote to memory of 2260 3244 msedge.exe 84 PID 3244 wrote to memory of 2260 3244 msedge.exe 84 PID 3244 wrote to memory of 3772 3244 msedge.exe 85 PID 3244 wrote to memory of 3772 3244 msedge.exe 85 PID 3244 wrote to memory of 3772 3244 msedge.exe 85 PID 3244 wrote to memory of 3772 3244 msedge.exe 85 PID 3244 wrote to memory of 3772 3244 msedge.exe 85 PID 3244 wrote to memory of 3772 3244 msedge.exe 85 PID 3244 wrote to memory of 3772 3244 msedge.exe 85 PID 3244 wrote to memory of 3772 3244 msedge.exe 85 PID 3244 wrote to memory of 3772 3244 msedge.exe 85 PID 3244 wrote to memory of 3772 3244 msedge.exe 85 PID 3244 wrote to memory of 3772 3244 msedge.exe 85 PID 3244 wrote to memory of 3772 3244 msedge.exe 85 PID 3244 wrote to memory of 3772 3244 msedge.exe 85 PID 3244 wrote to memory of 3772 3244 msedge.exe 85 PID 3244 wrote to memory of 3772 3244 msedge.exe 85 PID 3244 wrote to memory of 3772 3244 msedge.exe 85 PID 3244 wrote to memory of 3772 3244 msedge.exe 85 PID 3244 wrote to memory of 3772 3244 msedge.exe 85 PID 3244 wrote to memory of 3772 3244 msedge.exe 85 PID 3244 wrote to memory of 3772 3244 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\918a00be4601689d06a8208e61808626_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0aba46f8,0x7fff0aba4708,0x7fff0aba47182⤵PID:4444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12962974114978918980,15896531501642138867,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:3552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,12962974114978918980,15896531501642138867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,12962974114978918980,15896531501642138867,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:82⤵PID:3772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12962974114978918980,15896531501642138867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:5116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12962974114978918980,15896531501642138867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:2144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12962974114978918980,15896531501642138867,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4632 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2568
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4220
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
- MD5 a8e767fd33edd97d306efb6905f93252
- SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
- SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
- MD5 439b5e04ca18c7fb02cf406e6eb24167
- SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
- SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 8f1331ac0bc710ab4993e000f31bb17176a04fc8743574ef01744d53987fb02f
- MD5 3a719430ffdb4005610ef2d507dc6bf4
- SHA1 9750eb10dee27a2783292fba1af4c0a8dcfa253a
- SHA512 ccaec1d78772d6489f8d091b51508e4509003965b09b420f3ef0bc4549d69787a9d366531742ee50976dd567202be0cdfa69be00e2ac2005980fbdf3168c483d
- SSDEEP 96:nlkfn1G1wpvWMoiVmdeHBrzpUWQyV+VDCziEwb:nlkvQ1GWMXPro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 769255f144baccdd874f3b4147c3a11f08ce66b21737ee137dc0b7ffe3a69c82
- MD5 26db50f38199ea6b3c09e33dc6a12dd9
- SHA1 efa9a3e80cb371a40446ea9af565974814ea47f0
- SHA512 cd5b6200b5610b1a4afe8dc1cf15f49161e9cba63335f03aab37ea96dc7668655b670b47a4cc2c38cc97a85b757614243f2d857e09e685c3cf56611315bdc875
- SSDEEP 96:nlkWn1GQwpvWMoiVmdeHBrFpUWQyV+VDCAiEwb:nlkEQQGWMXlrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 cc4605ec81779123c702fb92321fef00fce670d74ee0efb2661c1365e52adb05
- MD5 ace40613f5f436740361b3800f711f8c
- SHA1 a5d628ae3489cae3dbbfc25aa78a4cab69f87d6c
- SHA512 38d1bd70a2faa6d3147c99c05212811f8639c71ef01394786b3a83ac5d3d7610c82f796484ce6847bee7f035db9245ab4c8dc77e80752202c14397a3b3fb5774
- SSDEEP 96:nlkWn1G1wpvWMoiVmdeHBrzpUWQyV+VDCAiEwb:nlkEQ1GWMXPrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 d717d8078cdfd93763135becb07ecae9dfd89e35d0a8043afbbca1f23dbf0cc0
- MD5 ee8d5a21902aad985854c14f915d8977
- SHA1 5c4ac2b22475f1d1b732cbbcb63f089ea929ece4
- SHA512 159173691e7c4b2311936cad3a0ff9176b95fd4b49503603917edadbc8c9d5286e9266e5da1823d46573a483183e0bf3a16bf5b40eef6b5aaf20c246f8579214
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupVHzYde2RUmMj293z2OMDCM:A9iIxuERzA83h09RZxYVHzY5qy9aOMWM
- MD5 SHA1 SHA512 SSDEEP