Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 13:04
Static task
static1
Behavioral task
behavioral1
Sample
91e2921a9e7c216f2fddc6f9f3d83679_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
91e2921a9e7c216f2fddc6f9f3d83679_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 91e2921a9e7c216f2fddc6f9f3d83679_JaffaCakes118.html
- Size 140KB
- Sample240603-qbdbbsfd2w
- SHA256 7ad721b2aa9b969e63f112bcc48f187f1bc48e2ad5cad5cee88c8c0362b8f2ed
- MD5 91e2921a9e7c216f2fddc6f9f3d83679
- SHA1 7b31d98a6f978ce843e073f07d38c07f93fde61e
- SHA512 aa9d522dfaa93ad48834d8508e22e080f76ac55ddfa9a84c648b6104ca58ef6941f896929110890b7c02e8c782e512e553bd4eaeed36349547e280250924399d
- SSDEEP 1536:ShvZVCira7zWlQyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:ShdezfyfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 776 msedge.exe 776 msedge.exe 1020 msedge.exe 1020 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1020 msedge.exe 1020 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe 1020 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1020 wrote to memory of 3220 1020 msedge.exe 81 PID 1020 wrote to memory of 3220 1020 msedge.exe 81 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 680 1020 msedge.exe 82 PID 1020 wrote to memory of 776 1020 msedge.exe 83 PID 1020 wrote to memory of 776 1020 msedge.exe 83 PID 1020 wrote to memory of 3712 1020 msedge.exe 84 PID 1020 wrote to memory of 3712 1020 msedge.exe 84 PID 1020 wrote to memory of 3712 1020 msedge.exe 84 PID 1020 wrote to memory of 3712 1020 msedge.exe 84 PID 1020 wrote to memory of 3712 1020 msedge.exe 84 PID 1020 wrote to memory of 3712 1020 msedge.exe 84 PID 1020 wrote to memory of 3712 1020 msedge.exe 84 PID 1020 wrote to memory of 3712 1020 msedge.exe 84 PID 1020 wrote to memory of 3712 1020 msedge.exe 84 PID 1020 wrote to memory of 3712 1020 msedge.exe 84 PID 1020 wrote to memory of 3712 1020 msedge.exe 84 PID 1020 wrote to memory of 3712 1020 msedge.exe 84 PID 1020 wrote to memory of 3712 1020 msedge.exe 84 PID 1020 wrote to memory of 3712 1020 msedge.exe 84 PID 1020 wrote to memory of 3712 1020 msedge.exe 84 PID 1020 wrote to memory of 3712 1020 msedge.exe 84 PID 1020 wrote to memory of 3712 1020 msedge.exe 84 PID 1020 wrote to memory of 3712 1020 msedge.exe 84 PID 1020 wrote to memory of 3712 1020 msedge.exe 84 PID 1020 wrote to memory of 3712 1020 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91e2921a9e7c216f2fddc6f9f3d83679_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb2aa46f8,0x7ffbb2aa4708,0x7ffbb2aa47182⤵PID:3220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15511185966993990697,17988802229180917413,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,15511185966993990697,17988802229180917413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,15511185966993990697,17988802229180917413,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:82⤵PID:3712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15511185966993990697,17988802229180917413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:4764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15511185966993990697,17988802229180917413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15511185966993990697,17988802229180917413,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4556
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2168
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
- MD5 56641592f6e69f5f5fb06f2319384490
- SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
- SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
- MD5 612a6c4247ef652299b376221c984213
- SHA1 d306f3b16bde39708aa862aee372345feb559750
- SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 2ca9f18b7981c433047c96c060282d29c1c72df03a852f85efa2b813e7c84d27
- MD5 cb4b73607853deb070091a631a7762ca
- SHA1 01c372bfe60546a950696780b71787e332b5a6d6
- SHA512 a91f5b518c69248c138d1ab3812e078c0d92ece9d82a70a42f8f232c30240759d0cc2d4680bc9348b376eed6e2eb32835f6f68b306fe7479757759384b1bfe99
- SSDEEP 96:n1kfP+1Fsn2wpvWMoiVmdeHk4SpUWQyV+VDCziEwb:n1k+4n2GWMXYpro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 709caa7d592052f47f3226fa974b671d3caad9372f9f9a47786a87861964eccf
- MD5 78bd2658612c5d4582ec0c8c0f5f0c8c
- SHA1 3d550a9b17c3406ce76cc344c5ac42ec8805096f
- SHA512 208f41f8048558e2749b9f625bd9407fa1666084d4339b6108ecc1d30e63719d545b1b8a139e3f067c9e8b1eb346a198b2273e71300431f46c81fbe7159a50bf
- SSDEEP 96:n1kWP+1Fsm2wpvWMoiVmdeHk4SpUWQyV+VDCAiEwb:n1kx4m2GWMXYprV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 aa271b51461e060bbe2d55e28c9d297c73dd11dbd684dea4c4f309e80d14db36
- MD5 48e73a348e66fa55e2429cab1f8170e9
- SHA1 6e1b309bf1b467e8c080f6003a5e25cf8f7409f4
- SHA512 8d0f820605390835651f95a7d11c7d1d0991170465ef1efee9bb7a66859882f7d08e0e0b6c8495a87a23fb8eef9e4a3b19cfddc7e574ba32c7d5e6e31afb5604
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupxZge2RUXyRVC3z2OMDCRHu:A9iIxuERzA83h09RZxYxYfCaOMWRHqlf
- MD5 SHA1 SHA512 SSDEEP