Analysis
- max time kernel
135s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 10:45
Static task
static1
Behavioral task
behavioral1
Sample
917d8dd1c7febea562d152a1292c30f4_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
917d8dd1c7febea562d152a1292c30f4_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 917d8dd1c7febea562d152a1292c30f4_JaffaCakes118.html
- Size 23KB
- Sample240603-mtwnvada88
- SHA256 fe26f120d8cff97ff24f269d398daec39bbb76941a5da9707e09bc33712f7a89
- MD5 917d8dd1c7febea562d152a1292c30f4
- SHA1 44a1fe76543ff4463a66f27857d3323bc5ab1113
- SHA512 b2ed89ccc96769958fe65c7052f91766273eec916df189f4983cb1bf67a7623ddb0df610302d3f67f674dbdf09f6d2400688b0592f1b8e2b95ab18bdaae7f244
- SSDEEP 384:7QEtMNaCLGwXggfJ/CiUcxLaM5OSL5vLogpoT2poSpoTpoYpo1pofooFVdQUutoT:erxJty/68XdQUurMjhkpVutjWCKph+XJ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3276 msedge.exe 3276 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1824 msedge.exe 1824 msedge.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1824 wrote to memory of 928 1824 msedge.exe 83 PID 1824 wrote to memory of 928 1824 msedge.exe 83 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 1400 1824 msedge.exe 84 PID 1824 wrote to memory of 3276 1824 msedge.exe 85 PID 1824 wrote to memory of 3276 1824 msedge.exe 85 PID 1824 wrote to memory of 2612 1824 msedge.exe 86 PID 1824 wrote to memory of 2612 1824 msedge.exe 86 PID 1824 wrote to memory of 2612 1824 msedge.exe 86 PID 1824 wrote to memory of 2612 1824 msedge.exe 86 PID 1824 wrote to memory of 2612 1824 msedge.exe 86 PID 1824 wrote to memory of 2612 1824 msedge.exe 86 PID 1824 wrote to memory of 2612 1824 msedge.exe 86 PID 1824 wrote to memory of 2612 1824 msedge.exe 86 PID 1824 wrote to memory of 2612 1824 msedge.exe 86 PID 1824 wrote to memory of 2612 1824 msedge.exe 86 PID 1824 wrote to memory of 2612 1824 msedge.exe 86 PID 1824 wrote to memory of 2612 1824 msedge.exe 86 PID 1824 wrote to memory of 2612 1824 msedge.exe 86 PID 1824 wrote to memory of 2612 1824 msedge.exe 86 PID 1824 wrote to memory of 2612 1824 msedge.exe 86 PID 1824 wrote to memory of 2612 1824 msedge.exe 86 PID 1824 wrote to memory of 2612 1824 msedge.exe 86 PID 1824 wrote to memory of 2612 1824 msedge.exe 86 PID 1824 wrote to memory of 2612 1824 msedge.exe 86 PID 1824 wrote to memory of 2612 1824 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\917d8dd1c7febea562d152a1292c30f4_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff825a646f8,0x7ff825a64708,0x7ff825a647182⤵PID:928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,13793071070049034646,2424887294662895814,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:1400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,13793071070049034646,2424887294662895814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,13793071070049034646,2424887294662895814,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:2612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13793071070049034646,2424887294662895814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13793071070049034646,2424887294662895814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:1600
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:8
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
- MD5 a8e767fd33edd97d306efb6905f93252
- SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
- SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
- MD5 439b5e04ca18c7fb02cf406e6eb24167
- SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
- SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 182B
- SHA256 4c7d2bb7f631e4d60278030e90bba17d19e024ba27d9b3e980587f3525561788
- MD5 21288b4d9c0c0113b527ea64b5388e34
- SHA1 634686f9842986ab0a3419eda6aa8f70f9c388cc
- SHA512 45cb5e6cac3cff3a39b3e7f14c3b7eca0003c69218d69a8426e7cb843ac87dcfcf5e8e2149da337265a8ad2aa9d899956686a7dc569875dfe33efbbc3ee50d71
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 acc6c592fe23d47f7e36e43779d4693c2555802944a0b193cd677019f8c42647
- MD5 9482f837d607b477a2a2ebfbcee906f2
- SHA1 9266c47f56f8b60379a4e38eb42c24165f8a4316
- SHA512 8fa1c0b41e0b280d9a0b6e37a09ad2a3b5b822583d1a29cb6eb04fc4f9035c8e45a9c98d396fe9f99bf11dce2f0edf5817d0d102f8f3b4b5e2e6b98a1ed58fda
- SSDEEP 96:nbkWYn14QwpvWMoiVmdeHBrzUwUWQyV+VDCAiEwb:nbkjnmQGWMXKwrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 6acf42902e4507a386fd0d05771aa8a5fdc9e6e5a782c277adb63edc82ea2063
- MD5 34da490c6eff47d27dc6435025eba40f
- SHA1 c46dbf2b5856284b015b75863c2a04fba229e3c3
- SHA512 9ed0bc415344a261a6f87e30d08d0d08fcd4a2c714a381fea257d82ab7734bc750b3b37f3ae6788554f6a8453638fe4ebf2e5d25e9d74288c4175dfd6f7a7887
- SSDEEP 96:nbkfYn141wpvWMoiVmdeHBrzUwUWQyV+VDCziEwb:nbkQnm1GWMXKwro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 6f8a7b6f1c525f3a0355f175894b67bfd403dc32078c1039a908eae6aded6fe8
- MD5 bd08e87a66cc154b85e62f726c5b188b
- SHA1 994832fa9775578fede1854c8c91c493b84ecc90
- SHA512 959dc409c887e81aef76cd8ff3f8d08bbc18359627d2a8c4302c1b306b055b85dc811eef48a23f00c672d30b084bdfb8414c4467073038fd302bda2b44a1b83c
- SSDEEP 96:nbkWYn141wpvWMoiVmdeHBrzUwUWQyV+VDCAiEwb:nbkjnm1GWMXKwrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 4f8c4731a65b3c7ebe452a44f34a2d8a8eb0d84a6bdbf251803cb516c125dc05
- MD5 b3297b605ba3ed8f72a487aa630e66f0
- SHA1 2af77aa787df1a9735a03c6ddc2b21661e130c43
- SHA512 6e29c5ae9b1b9dfeb8cd918b4cb9def9846453889dca11bac1f4feeda48bbce2fd365e4f1d66d16517310cac91941c3eb9a37a8b466260c4454e390790423154
- SSDEEP 96:nbkNYn14owpvWMoiVmdeHBrAPluryWQyV+VDCAiEwb:nbkSnmoGWMXC9urlV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 0dcd3412742d37d9d3963933776436e35dfa39750a9ad08c39bc1e9d41d3806f
- MD5 682481d1acaf329eee34cec678fc9808
- SHA1 7784a51d994988e7c83919567a0a57c8aa8d37bf
- SHA512 ecb51a415a160557323ad6549f5ae9908269c1a5e7ead1811211aff17f21555c1b275b1533c8ecc4e3eb90802a730dd3c30d168280b398765cbd78af9757e4d9
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup0Hle2RU44Mj2qT3z2OMDC2:A9iIxuERzA83h09RZxY0HB/jy8aOMWRc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 fec97a5f0b63c6c7e239d2ed8c1be92647599c654d0b037116333c9610ec39ce
- MD5 e1099f29ae1c3e07435c2acd09792835
- SHA1 91a6193580141ead74475e6dcae66bcb9d41d7cc
- SHA512 a13903d2ae185de547595eace4f521f32ef0e601817f14e4c8ea7d4d45173f6670b1b693bff1e6b03627cc498eb6689f172b08f0fee6b97bc7b3d4fbea4da986
- SSDEEP 192:1oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup0Hle2RUlJMj2H3z2OMDCRc:59iIxuERzA83h09RZxY0HB8SyHaOMWRc
- MD5 SHA1 SHA512 SSDEEP