Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 15:41
Static task
static1
Behavioral task
behavioral1
Sample
924db1449e1d7e5ae682c8ced5c7de77_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
924db1449e1d7e5ae682c8ced5c7de77_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 924db1449e1d7e5ae682c8ced5c7de77_JaffaCakes118.html
- Size 262KB
- Sample240603-s43sssbb7v
- SHA256 b309fcc5469bda71cbc050ef4cb689c9a11b54359c7f6ce5038b13b41d39a64d
- MD5 924db1449e1d7e5ae682c8ced5c7de77
- SHA1 b90cc1ea534fe1eb4b59613157d317d7bfba7cb4
- SHA512 82ec4ff1beada9323a5d72a36e6300d07485296baa94bc18bdc9d04f4d4a22c3cdeb93eff6cc2dd47a36f38e1c827e87398052f0cfe7a58836a5fc769e5f8f29
- SSDEEP 6144:l4Jwz138fU7ienQpfQLPya+9stwJfqALL5UeQ/dG3iGckBQmFDt4txfZXRylYGmk:uwzZ7ienQpfQLPya+9st0fqALL5UeQ/6
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2488 msedge.exe 2488 msedge.exe 3528 msedge.exe 3528 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe 3528 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3528 wrote to memory of 968 3528 msedge.exe 81 PID 3528 wrote to memory of 968 3528 msedge.exe 81 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 1408 3528 msedge.exe 82 PID 3528 wrote to memory of 2488 3528 msedge.exe 83 PID 3528 wrote to memory of 2488 3528 msedge.exe 83 PID 3528 wrote to memory of 1412 3528 msedge.exe 84 PID 3528 wrote to memory of 1412 3528 msedge.exe 84 PID 3528 wrote to memory of 1412 3528 msedge.exe 84 PID 3528 wrote to memory of 1412 3528 msedge.exe 84 PID 3528 wrote to memory of 1412 3528 msedge.exe 84 PID 3528 wrote to memory of 1412 3528 msedge.exe 84 PID 3528 wrote to memory of 1412 3528 msedge.exe 84 PID 3528 wrote to memory of 1412 3528 msedge.exe 84 PID 3528 wrote to memory of 1412 3528 msedge.exe 84 PID 3528 wrote to memory of 1412 3528 msedge.exe 84 PID 3528 wrote to memory of 1412 3528 msedge.exe 84 PID 3528 wrote to memory of 1412 3528 msedge.exe 84 PID 3528 wrote to memory of 1412 3528 msedge.exe 84 PID 3528 wrote to memory of 1412 3528 msedge.exe 84 PID 3528 wrote to memory of 1412 3528 msedge.exe 84 PID 3528 wrote to memory of 1412 3528 msedge.exe 84 PID 3528 wrote to memory of 1412 3528 msedge.exe 84 PID 3528 wrote to memory of 1412 3528 msedge.exe 84 PID 3528 wrote to memory of 1412 3528 msedge.exe 84 PID 3528 wrote to memory of 1412 3528 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\924db1449e1d7e5ae682c8ced5c7de77_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab30c46f8,0x7ffab30c4708,0x7ffab30c47182⤵PID:968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,8375055102300856479,17556017266582979891,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:22⤵PID:1408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,8375055102300856479,17556017266582979891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1948,8375055102300856479,17556017266582979891,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵PID:1412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,8375055102300856479,17556017266582979891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:3168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,8375055102300856479,17556017266582979891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:1492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,8375055102300856479,17556017266582979891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:12⤵PID:1840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,8375055102300856479,17556017266582979891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1916 /prefetch:12⤵PID:1128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,8375055102300856479,17556017266582979891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:12⤵PID:532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,8375055102300856479,17556017266582979891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:12⤵PID:216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,8375055102300856479,17556017266582979891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:12⤵PID:1916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,8375055102300856479,17556017266582979891,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1972
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4896
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
- MD5 1ac52e2503cc26baee4322f02f5b8d9c
- SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
- SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
- MD5 b2a1398f937474c51a48b347387ee36a
- SHA1 922a8567f09e68a04233e84e5919043034635949
- SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 144B
- SHA256 4f60b566006dcbada3a3a366cced53fc4e8f68f0fe4d8ef82675b9d3f0e12d6d
- MD5 cefa8c7757b8ef7da351016cc99a2bfb
- SHA1 d97cb43c82b8f36cf7d40ce138e833ca8ad661d7
- SHA512 9ad7dd598157711db0ae7c56174971ba1ab0f51b9f95118fb3a66c6330d591272ed74bce65d296e19addb47817e0d51dcbce25334ef1caf3d83bf0f50b840656
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 2KB
- SHA256 928c6cbb847b523cf5cb9f8832319f53ee025b7424e03d4afcd5ab65b3004433
- MD5 f0a98ef7faeb40f1e8278e59bbd47045
- SHA1 4fa3df6992cc96012f359870e66c4e54bfa46de1
- SHA512 fa03ea2ee199c45f2e20e700df97e29eea5ca7b2b7af86c1821c9565553a2dd3e19188693081f58a14eecfc964d45b3aea7cba46bc7602a70e4ac1af8e5eb29e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 2KB
- SHA256 4444f3658a3dbea54d05c3df041bd6ac0e9eb929bb607182bd33b40010694f89
- MD5 14c522d4579544386948fa17ead3ace8
- SHA1 beec7313ab225b192cb2daa95992578c6a9149c5
- SHA512 99411c73579a3155e084cafbf4676ccece2f1bc6359c6fc09b910309bc9771c913fc78d2179b6ba29d9f55924cd4ab0f9f33f59c3d377117eaaa19ccf32e0071
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 640146982cd57395559febd314742b501dec338e5b9ed1cce4a7c7d95324a064
- MD5 8df81e30f22224be12b79877c896ab63
- SHA1 d3549fc9827f98dd345b75f8a64af92578cd19a7
- SHA512 a684f7e6e990847da6b84e2ce442a74bd7cc4d357d7507cccd800ffda7d0c3a25011a48721db73c5a2f3196a0ab7a4dad9e32a95b701ac5462f22422002242b0
- SSDEEP 96:nekMZe1zega9IQwpvWMoiVmdeHpCr5bCUWQyV+VDCziEwb:nekWeFNaCQGWMXpGbCro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 77a703f9beed8df1b8233ce0ca2c8c09113d2cf5e7592ff8291705ee7af64843
- MD5 26e2a448581a1ffd44f3df61da0c1c3a
- SHA1 bc6a359215a2a0f127a8d3209a01a2a6a3403de1
- SHA512 fa21756219a3edc153ccfcb9161b1ac7245f96f9e715386c71205597d3b425a8541a6c9d3ccf655f99d4958593045ec797787d10af20a6cac8a6969bf462e56e
- SSDEEP 96:nek3Ze1zega9IQwpvWMoiVmdeKWzEOIb6x2pCr5bCUWQyV+VDCAiEwb:nekpeFNaCQGWM6WYOk6x2pGbCrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
- Size 538B
- SHA256 ecd6d941b54351bfa7efd6ff353e37329a1027092f0e0263197377c3779b5d88
- MD5 2245b4b7dd9042dfcdfe434a9c22aeed
- SHA1 44eabf856a6c46d9934f1551c35d00a3f554e186
- SHA512 d5df5ff225d2d2c36fbaf67e827ecf527a65604a52738212857cc0c7bbd2fae65aa1ae6084ff8bbf3ad836e5cc15ca61759eb24f402ba22ec46c8237732edbb0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe591812.TMP
- Size 371B
- SHA256 b7b11a90b7ec021220c9e566a5c2c3d7310649bc07c749282160f41474bdd356
- MD5 f94b1f0c8c1b64edddaec3aca9474b55
- SHA1 22be69744efbda962c2463c7f1bfca37354098b4
- SHA512 1a05abca370be9a6458591772b0e2bbd9c7b2de4167f2ed31707a77d7355c222d5f6b22e351198a4ea28b78143d60c9d6b983372b3b200dd29829616d1e71424
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 b3600381a0f43c50234d384cff00ab672972b0107a9e4fb959b3423f3385042f
- MD5 42701b441d39ba00bfcbd96777ae4afd
- SHA1 620c9885af23c67dba27f271cf9c4baf4cc3ec09
- SHA512 b2608750aaf8a8355902d55683628ccb6c16ec72e772e1635f1240ff4d15aafc64e3e9af64711ff613c60903554ba1cf4eec6924f61a671bc190a23b1e1b1029
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupwkWe2RUK/jf7ZF3z2OMDCn:A9iIxuERzA83h09RZxYwk4fLzZFaOMWn
- MD5 SHA1 SHA512 SSDEEP