Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 14:56
Static task
static1
Behavioral task
behavioral1
Sample
922ff9677dfbe6a1be1b8b8ef3924ab7_JaffaCakes118.html
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
922ff9677dfbe6a1be1b8b8ef3924ab7_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 922ff9677dfbe6a1be1b8b8ef3924ab7_JaffaCakes118.html
- Size 214KB
- Sample240603-sba73sbd76
- SHA256 a0f0c97251087cd333e7be4111e62eef8bf2bd7d9542bd1dd0cefd935423738c
- MD5 922ff9677dfbe6a1be1b8b8ef3924ab7
- SHA1 4d08bea0f60530f3bf283460a5b2c401e74954be
- SHA512 637cb45724918ac5ffbf2a4dc7cb0237415a4e9aaeac0524ff2166c4419b012b456a963349609de20846417b95def8d10f61b37aed5d21353a6e349eb905e340
- SSDEEP 3072:NrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJ5:xz9VxLY7iAVLTBQJl5
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 948 msedge.exe 948 msedge.exe 4380 msedge.exe 4380 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4380 msedge.exe 4380 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4380 wrote to memory of 4576 4380 msedge.exe 82 PID 4380 wrote to memory of 4576 4380 msedge.exe 82 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 1580 4380 msedge.exe 83 PID 4380 wrote to memory of 948 4380 msedge.exe 84 PID 4380 wrote to memory of 948 4380 msedge.exe 84 PID 4380 wrote to memory of 2484 4380 msedge.exe 85 PID 4380 wrote to memory of 2484 4380 msedge.exe 85 PID 4380 wrote to memory of 2484 4380 msedge.exe 85 PID 4380 wrote to memory of 2484 4380 msedge.exe 85 PID 4380 wrote to memory of 2484 4380 msedge.exe 85 PID 4380 wrote to memory of 2484 4380 msedge.exe 85 PID 4380 wrote to memory of 2484 4380 msedge.exe 85 PID 4380 wrote to memory of 2484 4380 msedge.exe 85 PID 4380 wrote to memory of 2484 4380 msedge.exe 85 PID 4380 wrote to memory of 2484 4380 msedge.exe 85 PID 4380 wrote to memory of 2484 4380 msedge.exe 85 PID 4380 wrote to memory of 2484 4380 msedge.exe 85 PID 4380 wrote to memory of 2484 4380 msedge.exe 85 PID 4380 wrote to memory of 2484 4380 msedge.exe 85 PID 4380 wrote to memory of 2484 4380 msedge.exe 85 PID 4380 wrote to memory of 2484 4380 msedge.exe 85 PID 4380 wrote to memory of 2484 4380 msedge.exe 85 PID 4380 wrote to memory of 2484 4380 msedge.exe 85 PID 4380 wrote to memory of 2484 4380 msedge.exe 85 PID 4380 wrote to memory of 2484 4380 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\922ff9677dfbe6a1be1b8b8ef3924ab7_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaeba946f8,0x7ffaeba94708,0x7ffaeba947182⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4472405420534520506,14289377056143544997,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:1580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,4472405420534520506,14289377056143544997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,4472405420534520506,14289377056143544997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵PID:2484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4472405420534520506,14289377056143544997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:4200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4472405420534520506,14289377056143544997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4472405420534520506,14289377056143544997,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5000 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1680
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3488
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4428
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
- MD5 537815e7cc5c694912ac0308147852e4
- SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
- SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
- MD5 8b167567021ccb1a9fdf073fa9112ef0
- SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
- SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 906a59806da3c2c4ba654e7fdf0d35ec5f61ca9a63b589ed70748cc6f47d4899
- MD5 d70c4a5999d42bab7a752a3f7a450f05
- SHA1 cfda9e59edec1aedcfe48ac077623d53bde59804
- SHA512 d2dba883f120e0c107123c458ab1fa4dcdfd52ce1e85b379a8a573ca56044f607357c3d4858dec11079db7eb05caa20a78c2368fac787f5c6abc7906bbad7654
- SSDEEP 96:npkOM1k/9wpvWMoiVmdeHpRQ5UrUWQyV+VDCziEwb:npkPm/9GWMXpkUrro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 735cd1f72a36d230a5d734e09cebc399f1961963ef2a7037556faa3ee797d33d
- MD5 0f1f665b01c6ff619ec15e9e0d46a13a
- SHA1 5cbc50ae3e1b17c28980c36d3701e34e606bce1c
- SHA512 e849e8546c6b4965250912b5fb2ce7c2b9f7b9199fd0f9ddeabcd39690b037adf4149eeba8e63c9439c8339eb83fc7de4aa3344aec6de901c0e224289005ba10
- SSDEEP 96:npkFM1kq9wpvWMoiVmdeHpRQ5UrUWQyV+VDCAiEwb:npkqmq9GWMXpkUrrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 c1b398e1a6b8dafe10f71544e767da9e0e403d993eb8ed9a2dab8c6f6fc6e17a
- MD5 7796f57d5c041a34c4ddbe315edc6e0e
- SHA1 f7cb7f40813c1463793e97c2533c3a59b537ca6b
- SHA512 b07bdca68e9ce0f7f9e5d5c387eae7b596cf726aa1aad5fb6a249c8b1edff104c1e6d46a134dbdee4e3a5bbe4c49550bc1cc248ae6582c57884a5278fe31b95a
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDQe2RUaqTo3z2OMDCRHqlI:A9iIxuERzA83h09RZxYDOAoaOMWRHqlI
- MD5 SHA1 SHA512 SSDEEP