Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 13:33
Static task
static1
Behavioral task
behavioral1
Sample
91f736b65b502d4a73d7d28bd4f227ad_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
91f736b65b502d4a73d7d28bd4f227ad_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 91f736b65b502d4a73d7d28bd4f227ad_JaffaCakes118.html
- Size 156KB
- Sample240603-qtpr3she46
- SHA256 860d511a13f98ccb750c80ca68c78b6d1833df48fd4a7cce523b1951b8334871
- MD5 91f736b65b502d4a73d7d28bd4f227ad
- SHA1 875a1e28477ae982fef68ea53ecee2d3200acc4f
- SHA512 d07943d31ded430cb9debd1c890d5be976acee4f966215bf697c5ebdad57782e72359c5bb65b1fc1aedb9a03247c695a29163d883e49acb3711c74673c079c8c
- SSDEEP 3072:moVQihdRWTmif2Al0P54+/VZcHKuJbIhk9aa4:m9f2Alt+/V5
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5040 msedge.exe 5040 msedge.exe 1576 msedge.exe 1576 msedge.exe 1976 msedge.exe 1976 msedge.exe 1976 msedge.exe 1976 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1576 msedge.exe 1576 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe 1576 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1576 wrote to memory of 600 1576 msedge.exe 82 PID 1576 wrote to memory of 600 1576 msedge.exe 82 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 4580 1576 msedge.exe 83 PID 1576 wrote to memory of 5040 1576 msedge.exe 84 PID 1576 wrote to memory of 5040 1576 msedge.exe 84 PID 1576 wrote to memory of 1924 1576 msedge.exe 85 PID 1576 wrote to memory of 1924 1576 msedge.exe 85 PID 1576 wrote to memory of 1924 1576 msedge.exe 85 PID 1576 wrote to memory of 1924 1576 msedge.exe 85 PID 1576 wrote to memory of 1924 1576 msedge.exe 85 PID 1576 wrote to memory of 1924 1576 msedge.exe 85 PID 1576 wrote to memory of 1924 1576 msedge.exe 85 PID 1576 wrote to memory of 1924 1576 msedge.exe 85 PID 1576 wrote to memory of 1924 1576 msedge.exe 85 PID 1576 wrote to memory of 1924 1576 msedge.exe 85 PID 1576 wrote to memory of 1924 1576 msedge.exe 85 PID 1576 wrote to memory of 1924 1576 msedge.exe 85 PID 1576 wrote to memory of 1924 1576 msedge.exe 85 PID 1576 wrote to memory of 1924 1576 msedge.exe 85 PID 1576 wrote to memory of 1924 1576 msedge.exe 85 PID 1576 wrote to memory of 1924 1576 msedge.exe 85 PID 1576 wrote to memory of 1924 1576 msedge.exe 85 PID 1576 wrote to memory of 1924 1576 msedge.exe 85 PID 1576 wrote to memory of 1924 1576 msedge.exe 85 PID 1576 wrote to memory of 1924 1576 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91f736b65b502d4a73d7d28bd4f227ad_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff8ad3946f8,0x7ff8ad394708,0x7ff8ad3947182⤵PID:600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1852,5344618253952257332,3442106171308722968,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:22⤵PID:4580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1852,5344618253952257332,3442106171308722968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1852,5344618253952257332,3442106171308722968,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:82⤵PID:1924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,5344618253952257332,3442106171308722968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,5344618253952257332,3442106171308722968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1852,5344618253952257332,3442106171308722968,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1976
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3452
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
- MD5 ce4c898f8fc7601e2fbc252fdadb5115
- SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
- SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
- MD5 4158365912175436289496136e7912c2
- SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
- SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0e546cfd-e94c-4169-99d4-c5763a08de96.tmp
- Size 5KB
- SHA256 542de60eef07a419b1d4d36ea40803512ea91c6f874e06733cb606f586289067
- MD5 17d90fcfe83d3a6e6dbd02eaf9849645
- SHA1 9592fe20117b6dc2367f4fa84ee6d41ed1df5b0b
- SHA512 0506c81abacfc432a6ce91be166f4c662ddf57742f7f222652f6b77aad857c9435c8869b72fffbaca9bc285fe8d2bcd57fc3a967b952ea2e31cbdedaf888df74
- SSDEEP 96:nykvle1j4juwpvWMoiVmdeHvSSs3BUWQyV+VDCziEwb:nykteh4juGWMXS3Bro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 1KB
- SHA256 a696614fc33613d13d36369e2837cf1ee061bc8097b292c9df259b9919836670
- MD5 1617b1444d2a350c04bb0a10cb1a7aec
- SHA1 67c26da5b2aeb530b32e23809ea6912aaf4b8e64
- SHA512 5709601021947c0c424e6bf8bf9a61914908dab86801843327d2fe0e7e4bcfb18b9a4ab814de601a6a57b554b7d9550ec3011071ae80f101f55f88fca0199238
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 1KB
- SHA256 466ab311fc3c661c3a4690093188d9ae49f2776040c640a5e406d4f0e3425df2
- MD5 ff5a48108d67517380b95efb6458604a
- SHA1 59b9eaf91691d004f0c82e7eb5e9b1ae2f1eb625
- SHA512 b099e68b80d8bbfad4de0d6ba2aaf5aeac22e7b196d1484532bbfeb2481373fe128bb33bb0c357e9349530cbf0997ed245230154605b207005717bfa032513e7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 88e910b4ebf90362ade30f9940f7a0352df4697799e4c6791257ca9506a62a6b
- MD5 dc1118c3c00f0b22ee4f247c0a12809a
- SHA1 72b712ec94c07c592f59fe70bfc5e5f7754bdebd
- SHA512 1a72837fb769499744afea1b2d01dd0ae4b53d0e06297a213388639f5bcb3231e00563af9705e4bfb2d163a51108ee9f6b705047b5f111f068955816c10b1d36
- SSDEEP 96:nykGle1j4juwpvWMoiVmdeP6HJo2vSSs3BUWQyV+VDCAiEwb:nykWeh4juGWMf6HJo2S3BrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 d7496ed29d947b795c095930e5ffa40e686f909bca1c18f95fc7e6482a10ad29
- MD5 1adad7b0704d2dabd20168b18cabceaf
- SHA1 affcb785a3820cd5f38606e450008da8c65f8523
- SHA512 41adaf5775abe9efeecd1c898268333e751231129cb382dcd75f74538b342d3417dc7d13860655ed4c932d71ef24b26c1d77bc091a0bdb496c8be7a219cba787
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupYze2RUORuQ3z2OMDCRHqlo:A9iIxuERzA83h09RZxYYj8QaOMWRHqlo
- MD5 SHA1 SHA512 SSDEEP