Analysis
- max time kernel
145s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 15:44
Static task
static1
Behavioral task
behavioral1
Sample
92504c1039ca33a92d34acc9ae6a50c9_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
92504c1039ca33a92d34acc9ae6a50c9_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 92504c1039ca33a92d34acc9ae6a50c9_JaffaCakes118.html
- Size 59KB
- Sample240603-s6hkmscd95
- SHA256 e12bec29d35135513bcad4a48bc225ac006abfa74b7f4500de73a88958f054f0
- MD5 92504c1039ca33a92d34acc9ae6a50c9
- SHA1 cc94557cb311f15c8348a1bdad3cce3f170aea43
- SHA512 fc0a05e7969f0b9f5cbaaa3ba9ec338dc37b29e3f1b386ccec8aed8ab3fc4a030da694f3cf43034ab183cefa2d05b4eb1f1d12b4f32c0f401eabd3e6b54102a9
- SSDEEP 1536:rKIIPeHQ4UurFEc50ZTZa9zkvFdecHYTk+9tmE5Rc3oyGPwAWm:rKIIPeHQ4P50VZa9zkvFdecHYn63GPwW
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3512 msedge.exe 3512 msedge.exe 2844 msedge.exe 2844 msedge.exe 2280 msedge.exe 2280 msedge.exe 2280 msedge.exe 2280 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe 2844 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2844 wrote to memory of 4364 2844 msedge.exe 81 PID 2844 wrote to memory of 4364 2844 msedge.exe 81 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 2360 2844 msedge.exe 82 PID 2844 wrote to memory of 3512 2844 msedge.exe 83 PID 2844 wrote to memory of 3512 2844 msedge.exe 83 PID 2844 wrote to memory of 960 2844 msedge.exe 84 PID 2844 wrote to memory of 960 2844 msedge.exe 84 PID 2844 wrote to memory of 960 2844 msedge.exe 84 PID 2844 wrote to memory of 960 2844 msedge.exe 84 PID 2844 wrote to memory of 960 2844 msedge.exe 84 PID 2844 wrote to memory of 960 2844 msedge.exe 84 PID 2844 wrote to memory of 960 2844 msedge.exe 84 PID 2844 wrote to memory of 960 2844 msedge.exe 84 PID 2844 wrote to memory of 960 2844 msedge.exe 84 PID 2844 wrote to memory of 960 2844 msedge.exe 84 PID 2844 wrote to memory of 960 2844 msedge.exe 84 PID 2844 wrote to memory of 960 2844 msedge.exe 84 PID 2844 wrote to memory of 960 2844 msedge.exe 84 PID 2844 wrote to memory of 960 2844 msedge.exe 84 PID 2844 wrote to memory of 960 2844 msedge.exe 84 PID 2844 wrote to memory of 960 2844 msedge.exe 84 PID 2844 wrote to memory of 960 2844 msedge.exe 84 PID 2844 wrote to memory of 960 2844 msedge.exe 84 PID 2844 wrote to memory of 960 2844 msedge.exe 84 PID 2844 wrote to memory of 960 2844 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\92504c1039ca33a92d34acc9ae6a50c9_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff561b46f8,0x7fff561b4708,0x7fff561b47182⤵PID:4364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,17641864449753794484,6819659722718907591,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:2360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,17641864449753794484,6819659722718907591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,17641864449753794484,6819659722718907591,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:82⤵PID:960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17641864449753794484,6819659722718907591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:12⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17641864449753794484,6819659722718907591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:12⤵PID:4616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17641864449753794484,6819659722718907591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:12⤵PID:1936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,17641864449753794484,6819659722718907591,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2280
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1228
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3656
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
- MD5 ae54e9db2e89f2c54da8cc0bfcbd26bd
- SHA1 a88af6c673609ecbc51a1a60dfbc8577830d2b5d
- SHA512 e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
- MD5 f53207a5ca2ef5c7e976cbb3cb26d870
- SHA1 49a8cc44f53da77bb3dfb36fc7676ed54675db43
- SHA512 be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 96B
- SHA256 aad2c49a415cd955af1ddd8cea83f8c06caca95b638e43a56a772441afc11406
- MD5 f67617841fabcec6d4196241484cfd83
- SHA1 daf4ddc634cb28b6b5226eb3218d43471a53acfd
- SHA512 5007874201961f0845b850851231130278e7fd03429e03a31be7c444458583eb4278a71a4816ed22fee105b70d7fc6204168f58bc9dd452e6a111dbc216ff64a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 899B
- SHA256 ddf4fab1234d2a5113b5a3871a909227ec1766788beb2166ced999f5669574de
- MD5 5428f7f667b4e76159829df772eefc3d
- SHA1 038ce4a888c57c81bdff0efc60ae83e06775dd08
- SHA512 2b8b49c8d9b86699822747f13c2e27efb7bc9e796ff5bac2b92e2b68a0095dffef542f372991539ce408e306e3dc4aecb6dc4554ebee2973b5acd98b898d3049
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 269dd1191d2d2dbe7d2c84edfef4275d1bd7c71e88eb929660b92c0decba5a61
- MD5 664e05863c41243830af36d054e2cd23
- SHA1 cb1ecd886f75042472c91f87edcec11eb7b10cb2
- SHA512 a5d99b0f6bd4bd8846855d9af3f22832bc3509276ac44851936ca142ecd9a218ae8c6ce29fa61d100c6d9f178ab5b1f6de6340b4b31ebcc3e16b9a80b2cacc60
- SSDEEP 96:nVkMl1zPe8wpvWMoiVmdeHpw8E0A7rUWQyV+VDCziEwb:nVkAFPe8GWMXpwfvro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 454fe1514835220040c4b45b7fb44284ed21ed65ea65a58f8152652ab2c13eae
- MD5 3bcdab806fa0440974667e6800d30f3b
- SHA1 053cdb61fc2f1e92f4f466964ebc1e7718be4edc
- SHA512 38c869f00dea3bcd1208749e6acfefc649a1dbfb0d9b1cc0fbec4aca0f25b58864d177601d820893a385881961f50b19f76c6a4f13e84c43e51ebe3c4e5bdfb5
- SSDEEP 96:nVk3l1zPe8wpvWMoiVmde0ZVBd/2pw8E0A7rUWQyV+VDCAiEwb:nVk1FPe8GWMEZrd/2pwfvrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 ada7f3a236464d68c2e64c919cc26433ad7ead2d4cd4a53147380a33b56ebaf5
- MD5 b73710e05760ed538f20d4fd6bdd3e40
- SHA1 704a41cc6dbd8b26d8afa6965c56115a623b2bfa
- SHA512 1b009d6761270c101b4bf682604615e2a1c849cd740f44ae24eb01c0b297929044b95f59d6dd707b556d7bbdc521ca28bae7ba20c0c16ed713a65692f720333b
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDMXe2RUuJ+kK3z2OMDCRHy:A9iIxuERzA83h09RZxYm1KaOMWRHqlWQ
- MD5 SHA1 SHA512 SSDEEP