Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 13:32
Static task
static1
Behavioral task
behavioral1
Sample
91f6c8e5ae91d7bdbabf6acfeef27e3a_JaffaCakes118.html
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
91f6c8e5ae91d7bdbabf6acfeef27e3a_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 91f6c8e5ae91d7bdbabf6acfeef27e3a_JaffaCakes118.html
- Size 19KB
- Sample240603-qtel4she32
- SHA256 874223be025f72d6c76416711a3eee3b4b6961d1fbbda9f1f2070ae549d86033
- MD5 91f6c8e5ae91d7bdbabf6acfeef27e3a
- SHA1 e3ca325b69c043786d785b511a055c08747c81b1
- SHA512 82a9b2e0c34854c787ee118477be04d34f0ae507e865486b3ec7c04d13ede4634bf0c012b3cb690b492512b3ecb39728d47f806af6cf1b7d0f9dd40a88d31bb3
- SSDEEP 192:qywHPi1YSGChB/kBwnAlg/emUFbPCNVdkyiLWsVItdLLnuYWqKWf2bd:/wq1YSGChUwnAlGIFbPZIOhqff2B
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 524 msedge.exe 524 msedge.exe 2136 msedge.exe 2136 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2136 wrote to memory of 1944 2136 msedge.exe 81 PID 2136 wrote to memory of 1944 2136 msedge.exe 81 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 3648 2136 msedge.exe 82 PID 2136 wrote to memory of 524 2136 msedge.exe 83 PID 2136 wrote to memory of 524 2136 msedge.exe 83 PID 2136 wrote to memory of 3044 2136 msedge.exe 84 PID 2136 wrote to memory of 3044 2136 msedge.exe 84 PID 2136 wrote to memory of 3044 2136 msedge.exe 84 PID 2136 wrote to memory of 3044 2136 msedge.exe 84 PID 2136 wrote to memory of 3044 2136 msedge.exe 84 PID 2136 wrote to memory of 3044 2136 msedge.exe 84 PID 2136 wrote to memory of 3044 2136 msedge.exe 84 PID 2136 wrote to memory of 3044 2136 msedge.exe 84 PID 2136 wrote to memory of 3044 2136 msedge.exe 84 PID 2136 wrote to memory of 3044 2136 msedge.exe 84 PID 2136 wrote to memory of 3044 2136 msedge.exe 84 PID 2136 wrote to memory of 3044 2136 msedge.exe 84 PID 2136 wrote to memory of 3044 2136 msedge.exe 84 PID 2136 wrote to memory of 3044 2136 msedge.exe 84 PID 2136 wrote to memory of 3044 2136 msedge.exe 84 PID 2136 wrote to memory of 3044 2136 msedge.exe 84 PID 2136 wrote to memory of 3044 2136 msedge.exe 84 PID 2136 wrote to memory of 3044 2136 msedge.exe 84 PID 2136 wrote to memory of 3044 2136 msedge.exe 84 PID 2136 wrote to memory of 3044 2136 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91f6c8e5ae91d7bdbabf6acfeef27e3a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84b6d46f8,0x7ff84b6d4708,0x7ff84b6d47182⤵PID:1944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2899103802658342756,5964245558622871824,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,2899103802658342756,5964245558622871824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,2899103802658342756,5964245558622871824,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:3044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2899103802658342756,5964245558622871824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:1616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2899103802658342756,5964245558622871824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:2560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2899103802658342756,5964245558622871824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:12⤵PID:4208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2899103802658342756,5964245558622871824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1316 /prefetch:12⤵PID:2008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2899103802658342756,5964245558622871824,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5140 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:956
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2088
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
- MD5 4f7152bc5a1a715ef481e37d1c791959
- SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
- SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
- MD5 ea98e583ad99df195d29aa066204ab56
- SHA1 f89398664af0179641aa0138b337097b617cb2db
- SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 6eae1e1c4d848252cd3e14d95f3e27a86b8ea4bf36ddda2e53ad4b5a8611a79d
- MD5 e22562a2af7f88dbe1e3e056ffbadc32
- SHA1 8beb366bd2ecf81ed1f0079dc76de8e08bee5b69
- SHA512 b6396b7935511cc2dc5926580e4523c1071e0ca399571eb30896cbd8d4f2a5e454f1fe079bfe9ff33f085940f00b921129d704413f0b6eec0aa83fa630fb17a1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 187B
- SHA256 26c812d81524994ef63a2c7b7222edafe28a76f2c3f985c7c9c36b3411ce9722
- MD5 f4c7ed45791c5fe01581cd6bd3499283
- SHA1 45bb3b574c0fb8b7e6f9cfda89c69aa1ac49bd5b
- SHA512 c75ba1c8f34e6f8756464d7cb4bb27a1a5434372ab837c4bdde5dbe6b6f819f663217176ebded25ed2b999d0090832b4680b5331152c0aca3187093fc9d3a96f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 c21c0b1e9b8bf2bd6c13946d0d55f9fbd250a4ca96f5c481b6462c3811418013
- MD5 94966988a815bdd2d3efdc86ac4087b7
- SHA1 512640005bf46f39e48f1726559989c5416120c1
- SHA512 f35695db16c69f240c27eca93fc314d3d653691d99fbc0d850bb78d9ecf2686ae6502bd5ebacf01606fe58f8d20f8a62f907306cbde8bd7af79fd73eff1efda6
- SSDEEP 96:nckMPY1c633XwpvWMoiVmdeHp1kjXUWQyV+VDCziEwb:nckVy6nXGWMXp6Xro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 3cc0b35d09c5c9fa6816833b99811d6f991b75738f8ab9a586ce4f01adfcafe2
- MD5 21a21ed31fba35185c7a801d12df6a65
- SHA1 96a1dbcdb03cb347197b1680378cb3bdec3244ec
- SHA512 168683691d88a38d926c3175ea815f29a11ae1d0de4f7987af0abb968218ef7777f378cd4ab378087c4c9cdea26ec8cdbb9198ee6637e086d32d35cd68d6affa
- SSDEEP 96:nck3PY1c6U3XwpvWMoiVmdeHp1kjXUWQyV+VDCAiEwb:nckwy6AXGWMXp6XrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 5c80c78cd5c02a463edfd5c7d8a94e5c6106a3d4863da05cb943d6ea25dba08f
- MD5 f408308a518e76267d6f6203e338ee8c
- SHA1 1db3aec01ea3ea95584a75e6fffd7d01a07c090d
- SHA512 8b26ba23c05ee45df57385d2e3eba87e73afaad2b393a5efb557dae0c04d7946c717daecf7f7725afaebf43b851621ee024bec426bdd35d782fb1471192befc6
- SSDEEP 96:nck3PY1c633XwpvWMoiVmdeHp1kjXUWQyV+VDCAiEwb:nckwy6nXGWMXp6XrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 86571a73024278966f9318f75b4187402d595196b9190f57a6da00da90282214
- MD5 c90a67dc67b8106474a6f9a0e99e5bdd
- SHA1 e8bd1838c101c8cf8fbdb9abdcb81be995de2ba6
- SHA512 f509fef5df3b52f975fa3a171b0a45ebec68342bf828bd1397be0db3c221edf060e997735cd3f44704a4f9da17ea8b1f56dd5376da5ba5efd3a77ccd3f664a27
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupl71e2RUaMo5M3z2OMDCRH9:A9iIxuERzA83h09RZxYlFxjMaOMWRHqE
- MD5 SHA1 SHA512 SSDEEP