Analysis
- max time kernel
150s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 12:57
Static task
static1
Behavioral task
behavioral1
Sample
91de6c033054cdbbe418fefbb05e638d_JaffaCakes118.html
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
91de6c033054cdbbe418fefbb05e638d_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 91de6c033054cdbbe418fefbb05e638d_JaffaCakes118.html
- Size 170KB
- Sample240603-p69scagf43
- SHA256 a31b1119ffa5fc791130696279c1f1665007c217de81b57527d38ae599b8fc93
- MD5 91de6c033054cdbbe418fefbb05e638d
- SHA1 49fc093ac5903409faf9aa7781c546098b2778b2
- SHA512 38f86f3744ce377729a35297af86ce41037e427ac2b47eaf2779d11993730f9d10ebee49ae9a4a0a385c1f3812cbb54e58bb71a8e1007ad9e684a4c51d68ff12
- SSDEEP 3072:Sk31sAhmDOyfkMY+BES09JXAnyrZalI+YQ:SkyAhUrsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 912 msedge.exe 912 msedge.exe 2004 msedge.exe 2004 msedge.exe 2668 msedge.exe 2668 msedge.exe 2668 msedge.exe 2668 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2004 msedge.exe 2004 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2004 wrote to memory of 4092 2004 msedge.exe 82 PID 2004 wrote to memory of 4092 2004 msedge.exe 82 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 2040 2004 msedge.exe 83 PID 2004 wrote to memory of 912 2004 msedge.exe 84 PID 2004 wrote to memory of 912 2004 msedge.exe 84 PID 2004 wrote to memory of 2072 2004 msedge.exe 85 PID 2004 wrote to memory of 2072 2004 msedge.exe 85 PID 2004 wrote to memory of 2072 2004 msedge.exe 85 PID 2004 wrote to memory of 2072 2004 msedge.exe 85 PID 2004 wrote to memory of 2072 2004 msedge.exe 85 PID 2004 wrote to memory of 2072 2004 msedge.exe 85 PID 2004 wrote to memory of 2072 2004 msedge.exe 85 PID 2004 wrote to memory of 2072 2004 msedge.exe 85 PID 2004 wrote to memory of 2072 2004 msedge.exe 85 PID 2004 wrote to memory of 2072 2004 msedge.exe 85 PID 2004 wrote to memory of 2072 2004 msedge.exe 85 PID 2004 wrote to memory of 2072 2004 msedge.exe 85 PID 2004 wrote to memory of 2072 2004 msedge.exe 85 PID 2004 wrote to memory of 2072 2004 msedge.exe 85 PID 2004 wrote to memory of 2072 2004 msedge.exe 85 PID 2004 wrote to memory of 2072 2004 msedge.exe 85 PID 2004 wrote to memory of 2072 2004 msedge.exe 85 PID 2004 wrote to memory of 2072 2004 msedge.exe 85 PID 2004 wrote to memory of 2072 2004 msedge.exe 85 PID 2004 wrote to memory of 2072 2004 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91de6c033054cdbbe418fefbb05e638d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedb2d46f8,0x7ffedb2d4708,0x7ffedb2d47182⤵PID:4092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,8992670863388085308,2898457533310136352,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:2040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,8992670863388085308,2898457533310136352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,8992670863388085308,2898457533310136352,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:82⤵PID:2072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8992670863388085308,2898457533310136352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8992670863388085308,2898457533310136352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,8992670863388085308,2898457533310136352,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4912 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2668
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2656
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1300
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
- MD5 ce4c898f8fc7601e2fbc252fdadb5115
- SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
- SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
- MD5 4158365912175436289496136e7912c2
- SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
- SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 55b70a1b7a772e389d901566b5001e88cd96e950122ef312d93acc801a665b9d
- MD5 e9875f8c219b7b1680194a391e4d3ceb
- SHA1 db4f78872d0712720121d2a2507cdf9f86a8f9c0
- SHA512 c659a1517a7f033b5aaa836eff848268416128c7ed01b0da5e5f782f08bb23ced5cc8816738047ffc42167f34acafc4f03f569fa58ef1900977cb2b0d28f5438
- SSDEEP 96:nIkRD1ZI8juwpvWMoiVmdeHvSSrUWQyV+VDCziEwb:nIkpLI8juGWMXpro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 bf774e4013dc3d99655576bd736a7a59dd74738d80ae638d54eb4fe7493c447a
- MD5 83f62e0f84817cd5a04556d775e52350
- SHA1 fcc8a849aa595e05a15e5a9323cb107c66c50a81
- SHA512 e7d471c3d365d32effe2c36f5195ef14e236eec93cd7214ff1ffafc4feddfb5566a55c1cf7b4532f09b6388c1dcf80649a59bbd9282fcf97b79a34be63334378
- SSDEEP 96:nIk8D1ZIfjuwpvWMoiVmdeHvSSrUWQyV+VDCAiEwb:nIkiLIfjuGWMXprV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 c8fed1f93377bb34ea690b778fa2fe4ddec71698053fdb6840a29fde47683c80
- MD5 9187c49eb07ef7111ee8db5ab40c2260
- SHA1 209da46b9818f89193faaa2cc73fcddfcaf0d743
- SHA512 7c84565171f4e6b974a71ed26ea4278173ad67d257a13543a74aa7bc0a98f2bdd93c6db917a6e0f401a2cb08c38b1d53b57f50987b7087b989850bcbc037af6a
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup7Ie2RUg4uR3z2OMDCRHqli:A9iIxuERzA83h09RZxY7m7RaOMWRHqli
- MD5 SHA1 SHA512 SSDEEP