Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 15:44
Static task
static1
Behavioral task
behavioral1
Sample
9250500dae489cc6c8bb61895b513df7_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
9250500dae489cc6c8bb61895b513df7_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 9250500dae489cc6c8bb61895b513df7_JaffaCakes118.html
- Size 37KB
- Sample240603-s6jspscd96
- SHA256 97e17178f2543f7f730e0fdd14e7900091d322da5710debd26e3f5781352bd98
- MD5 9250500dae489cc6c8bb61895b513df7
- SHA1 6112a84b3ae578ee82a101f9d96a0b53d3af3746
- SHA512 f63720ac3ebfad9a0f9d7e98a868a6de2577080dab64cf5ebb2de127b1f06af4b5e238cbede001ab0e869e09134d4a89902a4446edf8a7de4338005b3422f538
- SSDEEP 768:ZDuwbcm1E4LjIsO5Sjx29Fin8R29jITQOVB+V/Wz01LkY:ZSwbcm1E4LjI55vkpLkY
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4884 msedge.exe 4884 msedge.exe 60 msedge.exe 60 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 60 msedge.exe 60 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe 60 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 60 wrote to memory of 5036 60 msedge.exe 83 PID 60 wrote to memory of 5036 60 msedge.exe 83 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 1056 60 msedge.exe 84 PID 60 wrote to memory of 4884 60 msedge.exe 85 PID 60 wrote to memory of 4884 60 msedge.exe 85 PID 60 wrote to memory of 2240 60 msedge.exe 86 PID 60 wrote to memory of 2240 60 msedge.exe 86 PID 60 wrote to memory of 2240 60 msedge.exe 86 PID 60 wrote to memory of 2240 60 msedge.exe 86 PID 60 wrote to memory of 2240 60 msedge.exe 86 PID 60 wrote to memory of 2240 60 msedge.exe 86 PID 60 wrote to memory of 2240 60 msedge.exe 86 PID 60 wrote to memory of 2240 60 msedge.exe 86 PID 60 wrote to memory of 2240 60 msedge.exe 86 PID 60 wrote to memory of 2240 60 msedge.exe 86 PID 60 wrote to memory of 2240 60 msedge.exe 86 PID 60 wrote to memory of 2240 60 msedge.exe 86 PID 60 wrote to memory of 2240 60 msedge.exe 86 PID 60 wrote to memory of 2240 60 msedge.exe 86 PID 60 wrote to memory of 2240 60 msedge.exe 86 PID 60 wrote to memory of 2240 60 msedge.exe 86 PID 60 wrote to memory of 2240 60 msedge.exe 86 PID 60 wrote to memory of 2240 60 msedge.exe 86 PID 60 wrote to memory of 2240 60 msedge.exe 86 PID 60 wrote to memory of 2240 60 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9250500dae489cc6c8bb61895b513df7_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef99446f8,0x7ffef9944708,0x7ffef99447182⤵PID:5036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6478903999274374677,17565757457505688749,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:1056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,6478903999274374677,17565757457505688749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,6478903999274374677,17565757457505688749,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:82⤵PID:2240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6478903999274374677,17565757457505688749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:4072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6478903999274374677,17565757457505688749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:4076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6478903999274374677,17565757457505688749,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:848
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5064
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
- MD5 ce4c898f8fc7601e2fbc252fdadb5115
- SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
- SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
- MD5 4158365912175436289496136e7912c2
- SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
- SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 309B
- SHA256 356ee6486439ca30726bf114d48f71db99bf4752294ee21badc6940c98fa1bc2
- MD5 ac6e54838914d4af29f64811c8b00c19
- SHA1 62ca7bdb2b7ed44e6b3d1af21c70f157f63fbf4d
- SHA512 7f8ae7b55e649b9f56dd9ecbbacff2caed3a384d7f8ad314eb2328eeda288fc8a0198d9d713587decb0543711096e19f37971ec37811bca6bb34a575b1444afd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 279fc83a4ce5fa0bd48ce3ba7c0f228dc84b33033aae85cf6fc49e574dce2577
- MD5 970966dae469b3619f845686de3acbee
- SHA1 d283c7714ce5f4b548e918519602dc63dc1a8289
- SHA512 62da5000a8641b6c092dd43ed211d0aed0ec9ac4612adf0fcd76f3765595bd13efb33f4ca923302adc99f1f16b9068027733f6664b9ffe17ec7ef0b9a8623170
- SSDEEP 96:nPkW51qVgjuwpvWMoiVmdeZV2vSS7dw8UWQyV+VDCAiEwb:nPkaYVgjuGWMJV2Bdw8rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 8f25bd080ad6cdf1695d0a18ea727a581618ea3fb054b405382c64cfd67d75cf
- MD5 a5bc6ef2ee8818226017402a905f4bc8
- SHA1 1b705c07eb6189a131a28866cc98a44b8cfcd97f
- SHA512 dc6b566b61b5e13e9e9292d68c74e076252bd0a453b88897c4fd666cc091f6dede871941468e119a19355acc6683347f159f9037386fbedbb4b0b470e0ba9208
- SSDEEP 96:nPkf51qVgjuwpvWMoiVmdeHvSS7dw8UWQyV+VDCziEwb:nPkRYVgjuGWMXBdw8ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 841d6dff485469444616332978a806a658666c77b3e228ca549a5c4ddddcbafd
- MD5 dfe5e06f327b30ff0bb606de21e36017
- SHA1 ec4fffd10e7f48ca602c6826c51529bd73b5dcb5
- SHA512 75839e4d09a5f12b8465d2a02f034a7702a85010db27f01a9a5f6588383e3b415c2baabd28d27bb832cf1ad33b0400df34fa806fc47ce6a4ed8c669a0e305eff
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupkle2RUJuRuF3z2OMDCRHqF:A9iIxuERzA83h09RZxYkBaFaOMWRHqlP
- MD5 SHA1 SHA512 SSDEEP