Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 14:00
Static task
static1
Behavioral task
behavioral1
Sample
920b45282313fff67f6bc6602de3783f_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
920b45282313fff67f6bc6602de3783f_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 920b45282313fff67f6bc6602de3783f_JaffaCakes118.html
- Size 220KB
- Sample240603-rbae4sgh2v
- SHA256 c2c0749121519eb9757f02cf1bb4ae0a6c460116960dc367b8691d775669e8bb
- MD5 920b45282313fff67f6bc6602de3783f
- SHA1 9954ea292c7e89fd3b142bbd22bf6b6e0873238f
- SHA512 a3332e68c4f882307fd918b67245596f99e73e632dda86e1db8d7c06ac1be3389b7b760b747cdf4d28eabf6e8f4db202a3ca1fb644336b14c6788d5dfd43c20f
- SSDEEP 3072:S9CA7ndHMplc4yfkMY+BES09JXAnyrZalI+YQ:S9DS8sMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2652 msedge.exe 2652 msedge.exe 1160 msedge.exe 1160 msedge.exe 3092 msedge.exe 3092 msedge.exe 3092 msedge.exe 3092 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1160 msedge.exe 1160 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1160 wrote to memory of 4436 1160 msedge.exe 83 PID 1160 wrote to memory of 4436 1160 msedge.exe 83 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 1412 1160 msedge.exe 84 PID 1160 wrote to memory of 2652 1160 msedge.exe 85 PID 1160 wrote to memory of 2652 1160 msedge.exe 85 PID 1160 wrote to memory of 1644 1160 msedge.exe 86 PID 1160 wrote to memory of 1644 1160 msedge.exe 86 PID 1160 wrote to memory of 1644 1160 msedge.exe 86 PID 1160 wrote to memory of 1644 1160 msedge.exe 86 PID 1160 wrote to memory of 1644 1160 msedge.exe 86 PID 1160 wrote to memory of 1644 1160 msedge.exe 86 PID 1160 wrote to memory of 1644 1160 msedge.exe 86 PID 1160 wrote to memory of 1644 1160 msedge.exe 86 PID 1160 wrote to memory of 1644 1160 msedge.exe 86 PID 1160 wrote to memory of 1644 1160 msedge.exe 86 PID 1160 wrote to memory of 1644 1160 msedge.exe 86 PID 1160 wrote to memory of 1644 1160 msedge.exe 86 PID 1160 wrote to memory of 1644 1160 msedge.exe 86 PID 1160 wrote to memory of 1644 1160 msedge.exe 86 PID 1160 wrote to memory of 1644 1160 msedge.exe 86 PID 1160 wrote to memory of 1644 1160 msedge.exe 86 PID 1160 wrote to memory of 1644 1160 msedge.exe 86 PID 1160 wrote to memory of 1644 1160 msedge.exe 86 PID 1160 wrote to memory of 1644 1160 msedge.exe 86 PID 1160 wrote to memory of 1644 1160 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\920b45282313fff67f6bc6602de3783f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6b7d46f8,0x7ffd6b7d4708,0x7ffd6b7d47182⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,6004450201735180371,1375557340966857447,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:22⤵PID:1412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,6004450201735180371,1375557340966857447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,6004450201735180371,1375557340966857447,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:82⤵PID:1644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6004450201735180371,1375557340966857447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:3140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6004450201735180371,1375557340966857447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,6004450201735180371,1375557340966857447,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3092
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4432
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
- MD5 56641592f6e69f5f5fb06f2319384490
- SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
- SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
- MD5 612a6c4247ef652299b376221c984213
- SHA1 d306f3b16bde39708aa862aee372345feb559750
- SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 7fc39d7fc81013d79a1a52c08433ea5088120da485aaf035f3047ceacc2b52c9
- MD5 07e6095e6db50e212ca414ae5da2acfd
- SHA1 1e3103647ef518a623737955dc1cfc77905138f8
- SHA512 84d66675a2cee16a3906a76f2cfb79b154bb41cef9751d1217d72bd101357372acbeb365e172124c8b9bf4b717e71cde3e3b1e0d5d44b83b059136217e2b0174
- SSDEEP 96:nIkfT1xQn2wpvWMoiVmdeHk4bUWQyV+VDCziEwb:nIkrMn2GWMXBro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 33f5e8cec0a1b1302864e5e161aa61f90daae1e14a64a06cc5a1c705ab0606ef
- MD5 d59181bd55098efd1d24bdc7f0288602
- SHA1 40f7ffcf1dcd8d556508acfdb2d932ba9f9a25a0
- SHA512 ca541fef50466b665809ecf5829f67f2e7363e7b96eff08f5b0e2e50f1ed4c50e8d7712514016da34294fa3e18c9b5ee8a89f008b7f37d36d042b590cd5f898b
- SSDEEP 96:nIkWT1xQm2wpvWMoiVmdeHk4bUWQyV+VDCAiEwb:nIkAMm2GWMXBrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 b898c26b3902098cc5e81f77184a30c36d20ea76910bc896f1e3cf61d69e855e
- MD5 548566fbcaff9cb6993c3d9a45bae22b
- SHA1 e0aa3a20c3fa8302a26e407a753a0c4f4207d129
- SHA512 e66b0085e7ab5206ae20dbaa457efcbcf63274e6ef8d95bf83726af6560f219bc6771f064b23527044f33a68ec3b88df77eeac5b4885840cc837232e65427d62
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup0oe2RUHy4Vj3z2OMDCRHqi:A9iIxuERzA83h09RZxYX8jaOMWRHqlWT
- MD5 SHA1 SHA512 SSDEEP