Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
9252fef9b21046f0da2ddbe3a28158a8_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
9252fef9b21046f0da2ddbe3a28158a8_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 9252fef9b21046f0da2ddbe3a28158a8_JaffaCakes118.html
- Size 139KB
- Sample240603-s8elrsbc9v
- SHA256 888f15f4aeb9476539cd0aa968e75d2bbee59d99a0d560c26607ed1eed91dd83
- MD5 9252fef9b21046f0da2ddbe3a28158a8
- SHA1 6d9f5f4a5bbbcfe7772f47439151599fee2d1441
- SHA512 dfc24d2aabc900ca0b1aac416bccf3a7244fb8e2fb1877f37858b07128367eaa49cce589d2a6d96ece4e876e43da4e42a9b437dc63c1318f9a786fe764473aeb
- SSDEEP 3072:SGdOF1e1iLyfkMY+BES09JXAnyrZalI+YQ:SGdbsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4220 msedge.exe 4220 msedge.exe 3948 msedge.exe 3948 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3948 msedge.exe 3948 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3948 wrote to memory of 4776 3948 msedge.exe 83 PID 3948 wrote to memory of 4776 3948 msedge.exe 83 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 2992 3948 msedge.exe 84 PID 3948 wrote to memory of 4220 3948 msedge.exe 85 PID 3948 wrote to memory of 4220 3948 msedge.exe 85 PID 3948 wrote to memory of 3576 3948 msedge.exe 86 PID 3948 wrote to memory of 3576 3948 msedge.exe 86 PID 3948 wrote to memory of 3576 3948 msedge.exe 86 PID 3948 wrote to memory of 3576 3948 msedge.exe 86 PID 3948 wrote to memory of 3576 3948 msedge.exe 86 PID 3948 wrote to memory of 3576 3948 msedge.exe 86 PID 3948 wrote to memory of 3576 3948 msedge.exe 86 PID 3948 wrote to memory of 3576 3948 msedge.exe 86 PID 3948 wrote to memory of 3576 3948 msedge.exe 86 PID 3948 wrote to memory of 3576 3948 msedge.exe 86 PID 3948 wrote to memory of 3576 3948 msedge.exe 86 PID 3948 wrote to memory of 3576 3948 msedge.exe 86 PID 3948 wrote to memory of 3576 3948 msedge.exe 86 PID 3948 wrote to memory of 3576 3948 msedge.exe 86 PID 3948 wrote to memory of 3576 3948 msedge.exe 86 PID 3948 wrote to memory of 3576 3948 msedge.exe 86 PID 3948 wrote to memory of 3576 3948 msedge.exe 86 PID 3948 wrote to memory of 3576 3948 msedge.exe 86 PID 3948 wrote to memory of 3576 3948 msedge.exe 86 PID 3948 wrote to memory of 3576 3948 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9252fef9b21046f0da2ddbe3a28158a8_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5eb246f8,0x7ffd5eb24708,0x7ffd5eb247182⤵PID:4776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17686699899373376907,7272748858664486818,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,17686699899373376907,7272748858664486818,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,17686699899373376907,7272748858664486818,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵PID:3576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17686699899373376907,7272748858664486818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17686699899373376907,7272748858664486818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17686699899373376907,7272748858664486818,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4664
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4724
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
- MD5 ce4c898f8fc7601e2fbc252fdadb5115
- SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
- SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
- MD5 4158365912175436289496136e7912c2
- SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
- SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 25824c2beae4102ee5106ce9505e5f73418114c67b563f7e37722cb6c59c74b2
- MD5 c34bb26f585e7ad353c1d47235a392df
- SHA1 7f8411580e71e1bc6a130e91ad7898cf0152abab
- SHA512 c0f61a239099968e0defc9359ef670834d109a9f4ffbdaac31b9b719fcac266339d8e1057f5261da2c1cefd696701b806dc416fb15b4404e25784ebdc0582b97
- SSDEEP 96:nRkRX1g8juwpvWMoiVmdeHvSSbUWQyV+VDCziEwb:nRk1O8juGWMXBro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 1304d368566dcb3d6efcf9c21f9990fe5a24e72adabbefa4d569618642603c59
- MD5 b589c99c584f2464599644cb8d7f2e6e
- SHA1 0abafb200e88c8b160de9ba43fc6a02558f10d57
- SHA512 e14ab4f4bec30ffd38c72bf6e4ac610fa03d468b815e65d8004c0ec4c5a4bc0a7a3402f241ee1f6d3b87af1e46351cb112534c93cbe67c60d5daacb67a48ed05
- SSDEEP 96:nRk8X1gfjuwpvWMoiVmdeHvSSbUWQyV+VDCAiEwb:nRkGOfjuGWMXBrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 fdc6ee4fbbbf90e999131551cbc40808701a7ea0f8f65474b3bdff9498135e64
- MD5 419756657aef62ccd9be8d1413592092
- SHA1 7ed621c025acdf623da8c4fb060beed123cae5b7
- SHA512 d49c377403c25f1bc916e5104ddced8336d90f62f6b0abe1c10c64bdf985c0b35a5fe2743324dbad744806c56d87bc04dfa847d92542494196e8d372a9a00fef
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfme2RUyRul3z2OMDCRHqlE:A9iIxuERzA83h09RZxYfo8laOMWRHqlE
- MD5 SHA1 SHA512 SSDEEP