Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 12:15
Static task
static1
Behavioral task
behavioral1
Sample
91c044937e33693420d0dca54a8bdbcc_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
91c044937e33693420d0dca54a8bdbcc_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 91c044937e33693420d0dca54a8bdbcc_JaffaCakes118.html
- Size 11KB
- Sample240603-pfa64aeb2v
- SHA256 06e6869445eee811057fa5e0125ecc90db0af1570f11f48396f8724b6519c7d3
- MD5 91c044937e33693420d0dca54a8bdbcc
- SHA1 6db322e680cee0ac57b6000f6c4fd5fb86599926
- SHA512 8e679c0ebf5e0ffd030b8fe2b257b711107300d4903680a9425e6ece4509d009857868c93553ddf73079330f2dc2b16269868c9bc465cb3af7f9b634ed1991e8
- SSDEEP 96:rdL3hP8De7KtYOh06IVvKEc+8UE/fo9g5Pm5SE5ie5cSGBrWNC4FE1i6uBGb4/ZN:FByheRNyi6AZAxzVcw9r02I5NaYa6aDu
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2940 msedge.exe 2940 msedge.exe 64 msedge.exe 64 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 64 msedge.exe 64 msedge.exe 64 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 64 wrote to memory of 4548 64 msedge.exe 83 PID 64 wrote to memory of 4548 64 msedge.exe 83 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 3324 64 msedge.exe 84 PID 64 wrote to memory of 2940 64 msedge.exe 85 PID 64 wrote to memory of 2940 64 msedge.exe 85 PID 64 wrote to memory of 1164 64 msedge.exe 86 PID 64 wrote to memory of 1164 64 msedge.exe 86 PID 64 wrote to memory of 1164 64 msedge.exe 86 PID 64 wrote to memory of 1164 64 msedge.exe 86 PID 64 wrote to memory of 1164 64 msedge.exe 86 PID 64 wrote to memory of 1164 64 msedge.exe 86 PID 64 wrote to memory of 1164 64 msedge.exe 86 PID 64 wrote to memory of 1164 64 msedge.exe 86 PID 64 wrote to memory of 1164 64 msedge.exe 86 PID 64 wrote to memory of 1164 64 msedge.exe 86 PID 64 wrote to memory of 1164 64 msedge.exe 86 PID 64 wrote to memory of 1164 64 msedge.exe 86 PID 64 wrote to memory of 1164 64 msedge.exe 86 PID 64 wrote to memory of 1164 64 msedge.exe 86 PID 64 wrote to memory of 1164 64 msedge.exe 86 PID 64 wrote to memory of 1164 64 msedge.exe 86 PID 64 wrote to memory of 1164 64 msedge.exe 86 PID 64 wrote to memory of 1164 64 msedge.exe 86 PID 64 wrote to memory of 1164 64 msedge.exe 86 PID 64 wrote to memory of 1164 64 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91c044937e33693420d0dca54a8bdbcc_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff485c46f8,0x7fff485c4708,0x7fff485c47182⤵PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4957397433450247432,17879601169169727324,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:3324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4957397433450247432,17879601169169727324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,4957397433450247432,17879601169169727324,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:82⤵PID:1164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4957397433450247432,17879601169169727324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:1300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4957397433450247432,17879601169169727324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4957397433450247432,17879601169169727324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:12⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4957397433450247432,17879601169169727324,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5336 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:876
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4876
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3620
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
- MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
- SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
- SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
- MD5 87f7abeb82600e1e640b843ad50fe0a1
- SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
- SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 74d33258878f5a5fad99777b7c5bc452461cc6ebcd0bec45a441c6166dbec4f1
- MD5 b4d94e860d8af5323542430dc15a023f
- SHA1 335f4c8524de315552992e98c8a0882b89df54cc
- SHA512 aaec78793f20599066d81fab6b02168afc6d9afa7bbfa4af657886ebef3fceebbb0d15db1e8303b44991da0b689045e3a8c9fb7bc83de05c18b4d3f839a11ce3
- SSDEEP 96:njkfZ17T0wpvWMoiVmdeH/zEDw+UWQyV+VDCziEwb:njkBFgGWMXww+ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 ae09fa4197f7bf5d1bc17da58236773276c855b2834f7d0880df7888ef2f6d19
- MD5 ae8b8269677465c33effde8c374edfd1
- SHA1 2e6189e541979b9ef3e9169df8ad01098fd42ae7
- SHA512 c33944cd3d172fb3cc423643ba215dd34e6235f2ee17644619615b0d1cff089c8b040789b318f8e0fa79ba6212a3d59bc79a046f9c0f72a330c181461db6c08b
- SSDEEP 96:njkWZ17T0wpvWMoiVmdeH/zEDw+UWQyV+VDCAiEwb:njkGFgGWMXww+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 6d073c7750d1c421051ce5fba481166c4025e1ebfbc0a065a2bb5d74611bc762
- MD5 e39fece272f0e4afce11fdc9fba8f217
- SHA1 8761c05e985684272173d65aa41e83ff899cd2d6
- SHA512 8db19a3d35417c0b74fbe19f214b48f0b593fa6fc20b7b299bd86b762fe9a40e447f2fc035e4e26e9469e3933a8fb7ee962c579c18add25161e3776416ba1ced
- SSDEEP 96:njkWZ17q0wpvWMoiVmdeH/SEDw+UWQyV+VDCAiEwb:njkGFZGWMXJw+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 923270344cd0766e0f4cc95fde4eb8d1093fd48ba310bab0d0fdc3b7b860051d
- MD5 c02f6b4f32c8d49c9b368a3a8645e29c
- SHA1 41d015a216cf438941fec64f9f1a2469026e86e1
- SHA512 cd6925ee5b662544c5f7e092af68abb1b59c0c2f6f3795593c0fa5c299d963eb08ae274ea10797a38f06694d48ba9cacc28a298665331579eee3e5f2980e20ab
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup2v4e2RUtmyN3z2OMDCRHqb:A9iIxuERzA83h09RZxYY2uNaOMWRHqlV
- MD5 SHA1 SHA512 SSDEEP