Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 13:04
Static task
static1
Behavioral task
behavioral1
Sample
91e25798e61b112d842e30b412d64f11_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
91e25798e61b112d842e30b412d64f11_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 91e25798e61b112d842e30b412d64f11_JaffaCakes118.html
- Size 117KB
- Sample240603-qbakfafd2t
- SHA256 010e6640afa96fd7afea6a45606c7cca1ea4827a1cc98629609eba599468d799
- MD5 91e25798e61b112d842e30b412d64f11
- SHA1 6289a7ecbbc8cbbaad65424cc48f1015043381f6
- SHA512 13287d44573e2580e245cc3ac0da24e7605e33991173626a81237fee0a4e76c888a5b749629194541e1821fba48189a22769b319e762e46545026f1c7b9be5cb
- SSDEEP 1536:S1MByHeyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9w:S6gHeyfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1272 msedge.exe 1272 msedge.exe 1124 msedge.exe 1124 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1124 wrote to memory of 4140 1124 msedge.exe 83 PID 1124 wrote to memory of 4140 1124 msedge.exe 83 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 4868 1124 msedge.exe 85 PID 1124 wrote to memory of 1272 1124 msedge.exe 86 PID 1124 wrote to memory of 1272 1124 msedge.exe 86 PID 1124 wrote to memory of 5428 1124 msedge.exe 87 PID 1124 wrote to memory of 5428 1124 msedge.exe 87 PID 1124 wrote to memory of 5428 1124 msedge.exe 87 PID 1124 wrote to memory of 5428 1124 msedge.exe 87 PID 1124 wrote to memory of 5428 1124 msedge.exe 87 PID 1124 wrote to memory of 5428 1124 msedge.exe 87 PID 1124 wrote to memory of 5428 1124 msedge.exe 87 PID 1124 wrote to memory of 5428 1124 msedge.exe 87 PID 1124 wrote to memory of 5428 1124 msedge.exe 87 PID 1124 wrote to memory of 5428 1124 msedge.exe 87 PID 1124 wrote to memory of 5428 1124 msedge.exe 87 PID 1124 wrote to memory of 5428 1124 msedge.exe 87 PID 1124 wrote to memory of 5428 1124 msedge.exe 87 PID 1124 wrote to memory of 5428 1124 msedge.exe 87 PID 1124 wrote to memory of 5428 1124 msedge.exe 87 PID 1124 wrote to memory of 5428 1124 msedge.exe 87 PID 1124 wrote to memory of 5428 1124 msedge.exe 87 PID 1124 wrote to memory of 5428 1124 msedge.exe 87 PID 1124 wrote to memory of 5428 1124 msedge.exe 87 PID 1124 wrote to memory of 5428 1124 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91e25798e61b112d842e30b412d64f11_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0xdc,0x7ffa12ce46f8,0x7ffa12ce4708,0x7ffa12ce47182⤵PID:4140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,1255181619620007102,2511975363006505433,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:22⤵PID:4868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,1255181619620007102,2511975363006505433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,1255181619620007102,2511975363006505433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:5428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,1255181619620007102,2511975363006505433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,1255181619620007102,2511975363006505433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:1912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,1255181619620007102,2511975363006505433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:12⤵PID:3344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,1255181619620007102,2511975363006505433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:12⤵PID:1612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,1255181619620007102,2511975363006505433,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2520 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3900
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4568
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
- MD5 a8e767fd33edd97d306efb6905f93252
- SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
- SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
- MD5 439b5e04ca18c7fb02cf406e6eb24167
- SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
- SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 1b944bfbfa451d1489db1cd304e95c6b38fac0688da9a7f9fc962c9e38235b7a
- MD5 f5b5f50125bdfde8d8ef31c5597f2f64
- SHA1 9d8bd17b9a85d4e9238b0630f146b163f243e41e
- SHA512 0f9310f111f8341766323d8d4861e86c251c27e64f61d133e6ffb313ed705a53bcb02b8a95a180efe61d17c1dc4a568b172c01f43f065d357c338bb7550ff814
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 187B
- SHA256 26c812d81524994ef63a2c7b7222edafe28a76f2c3f985c7c9c36b3411ce9722
- MD5 f4c7ed45791c5fe01581cd6bd3499283
- SHA1 45bb3b574c0fb8b7e6f9cfda89c69aa1ac49bd5b
- SHA512 c75ba1c8f34e6f8756464d7cb4bb27a1a5434372ab837c4bdde5dbe6b6f819f663217176ebded25ed2b999d0090832b4680b5331152c0aca3187093fc9d3a96f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 38e58eaf28080ba173ad479d39c6793e7df378602936785f1ac553ec29535c7f
- MD5 fe6c8fdd57176995a3204e16ed965b86
- SHA1 bd91024902d52de5ce338a28526225af27ce31eb
- SHA512 9c28b39f3d6b81f42c637f36f74aef00a01d0e13800ee34cc7c1fd51d2fd863712e16847b497f9e201cde765a86f9f55aa916232ea8fec3cb660b0b648a2f255
- SSDEEP 96:nykfy1t1wpvWMoiVmdeHBrz2UWQyV+VDCziEwb:nykKP1GWMXIro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 b38be07bf224d2e322c7b4212f3e692afc71395d7c2694b8114a552b74a4a8b6
- MD5 eac62f2cc2ba590921b1c35d13e0bb6a
- SHA1 498f88132db26a1fc797ac4e2566aa8a0ebcaf3f
- SHA512 92d5c1ee6bcc170dfb1d5343c2cd4ec4afa358407f0689882fc447460c01e0deafb302cf04f5629bc46e33ccaf3352d6d4280fd0d07e1ee7bf7f32aa0c529923
- SSDEEP 96:nykWy1tQwpvWMoiVmdeHBrz2UWQyV+VDCAiEwb:nyk9PQGWMXIrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 caa83dfec1ce37702da3e61205a6cf3b41a93533df812baa2a49852a9190c807
- MD5 3bebcbf2e1f54fe8bcd23c5b73195850
- SHA1 28e08985807cd1e81b64704fc1716748bad90ff3
- SHA512 f8881275e3a0bb0045fd1e4d38f368d6d6bcd8ca337581b06cfefd980c8c489e8384f23d350701fd8445fc4813b196ffa2a8a84eb9dea64816b62013217c5cc5
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupBHse2RU3Mj283z2OMDCRHO:A9iIxuERzA83h09RZxYBHyhy8aOMWRHO
- MD5 SHA1 SHA512 SSDEEP