Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 15:07
Static task
static1
Behavioral task
behavioral1
Sample
92372a68345d9d5b029c7c05b90108b9_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
92372a68345d9d5b029c7c05b90108b9_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 92372a68345d9d5b029c7c05b90108b9_JaffaCakes118.html
- Size 55KB
- Sample240603-shb3ysbf25
- SHA256 79d6ad72d4433e15c6e4733697439734d549125e9714c9da2b3e0f9184d0231a
- MD5 92372a68345d9d5b029c7c05b90108b9
- SHA1 730115604459afb649530f7b7ee05180645fe02e
- SHA512 c7ca5ec65ef0dab22b890293b4896cd3e0c86e857c6a697c79c9a71030b08591905276b00d8cfe6929869debafc5a4467161c82a56b55ca87154c608124e7c70
- SSDEEP 384:SnhB0OmlCr5My1cc9CXs7wq0pusuOyGFALNSlhyiwc5DFtRWrVgCEiYiEyAEcwQZ:SnhmOg+ZTDcDgO1ALN+wcJFtRyQK9TG
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3296 msedge.exe 3296 msedge.exe 4508 msedge.exe 4508 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4508 wrote to memory of 764 4508 msedge.exe 84 PID 4508 wrote to memory of 764 4508 msedge.exe 84 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 5076 4508 msedge.exe 85 PID 4508 wrote to memory of 3296 4508 msedge.exe 86 PID 4508 wrote to memory of 3296 4508 msedge.exe 86 PID 4508 wrote to memory of 2384 4508 msedge.exe 87 PID 4508 wrote to memory of 2384 4508 msedge.exe 87 PID 4508 wrote to memory of 2384 4508 msedge.exe 87 PID 4508 wrote to memory of 2384 4508 msedge.exe 87 PID 4508 wrote to memory of 2384 4508 msedge.exe 87 PID 4508 wrote to memory of 2384 4508 msedge.exe 87 PID 4508 wrote to memory of 2384 4508 msedge.exe 87 PID 4508 wrote to memory of 2384 4508 msedge.exe 87 PID 4508 wrote to memory of 2384 4508 msedge.exe 87 PID 4508 wrote to memory of 2384 4508 msedge.exe 87 PID 4508 wrote to memory of 2384 4508 msedge.exe 87 PID 4508 wrote to memory of 2384 4508 msedge.exe 87 PID 4508 wrote to memory of 2384 4508 msedge.exe 87 PID 4508 wrote to memory of 2384 4508 msedge.exe 87 PID 4508 wrote to memory of 2384 4508 msedge.exe 87 PID 4508 wrote to memory of 2384 4508 msedge.exe 87 PID 4508 wrote to memory of 2384 4508 msedge.exe 87 PID 4508 wrote to memory of 2384 4508 msedge.exe 87 PID 4508 wrote to memory of 2384 4508 msedge.exe 87 PID 4508 wrote to memory of 2384 4508 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\92372a68345d9d5b029c7c05b90108b9_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd329346f8,0x7ffd32934708,0x7ffd329347182⤵PID:764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,16427439099574145525,6401692916303728793,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:22⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,16427439099574145525,6401692916303728793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,16427439099574145525,6401692916303728793,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:2384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,16427439099574145525,6401692916303728793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:4992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,16427439099574145525,6401692916303728793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,16427439099574145525,6401692916303728793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:12⤵PID:4600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,16427439099574145525,6401692916303728793,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5980 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4304
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3504
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4008
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
- MD5 537815e7cc5c694912ac0308147852e4
- SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
- SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
- MD5 8b167567021ccb1a9fdf073fa9112ef0
- SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
- SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 c07dacfbc19f6bfcc98c892cc652b1a1447377d62ffb85cab1858925c67d0175
- MD5 9a1f33a26f223613c3f0ee38cfa4741c
- SHA1 5a81fc3577626797206c85adcd6b25733cd760d0
- SHA512 27c7e1f1062a30c8126ffb4cca2c377fff515382fddeba4d33fb16929af35757b368f3f676e34e475f8effb1067c6cc203dc15f02a075eb6fb1e60a0a3805b42
- SSDEEP 96:n4kFP415+9wpvWMoiVmdeYqpRDP/+UWQyV+VDCAiEwb:n4kx4n+9GWMoqpJ/+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 34cf8ca6bcba5052994cfa5e4f6c77865c4a26759a97583b63c73b271be559cd
- MD5 4a8f66be2f135d8089c1bb4a4e4c7946
- SHA1 41eeaaf9cf5635d8c02a931cfa84352297bcf95b
- SHA512 e467cc98349079eddad8da7498ba2997614ee95d75be5d788ed77349e971a70107e43fc01e4f117e5afd2ef1a9b3beda2a4c5e9df27ebcb63e9f2aa77563f631
- SSDEEP 96:n4kFP415/9wpvWMoiVmdeHpRQP/+UWQyV+VDCAiEwb:n4kx4n/9GWMXpy/+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 1cddaba3906222946846747af66632bd0cb696b87d2a3402117cb3d20814d6b6
- MD5 634fc8a00cfe2049c1ba38c8737977c7
- SHA1 6de7e92863cbe770b652c60e3c4773f7745aeea4
- SHA512 fe8d1a3e79fa499e499027ec4767d2b45f6dca0ea9d98b716ce6c07f380af1604bcbca2b66d259d18a2ec9c759c4c50aafaedb49030647ab505207d942cc6c3d
- SSDEEP 96:n4kOP415/9wpvWMoiVmdeHpRQP/+UWQyV+VDCziEwb:n4kw4n/9GWMXpy/+ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 c39645e651f7f4234348e3b9709146aaa7dbaa8afc0a58afcd51e576b5a100d7
- MD5 fa8a76c29bead51070cb5e813d9dd5d5
- SHA1 c28eb5718798cd3eccc42c5940806928ee07bc91
- SHA512 8f90f66527087122553a3348a6e39169e1522f5adfa8ded746ec38d8c834c253c98d0cbd0a0e769a1c7ea46f65d4a903730494ef2781f1eb55f58c519efacd4f
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupHTe2RU8qTj3z2OMDCRHqla:A9iIxuERzA83h09RZxYHDujaOMWRHqla
- MD5 SHA1 SHA512 SSDEEP