Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 15:16
Static task
static1
Behavioral task
behavioral1
Sample
923d0838d54609b9b9644e721cc39014_JaffaCakes118.html
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
923d0838d54609b9b9644e721cc39014_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 923d0838d54609b9b9644e721cc39014_JaffaCakes118.html
- Size 165KB
- Sample240603-snwdsaaf2w
- SHA256 ba18c10c0ee2caace69d854ea594f6847f846ef29cff38cb9bee4d86bdd7fb4a
- MD5 923d0838d54609b9b9644e721cc39014
- SHA1 d6fa98a503e0705f64a95f3c613e9b3322f79067
- SHA512 04c69409bd60cc3d03fc4573f0bff1ebea0d4750fa6fa1d60d1c72eed3a0cb535e0a1380d472d231634ccc093fb9512afc5e5f3405b0bb43d26670c25aaf532f
- SSDEEP 3072:SUYex5DPjIyyCUyfkMY+BES09JXAnyrZalI+YQ:SUDPJhZsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3488 msedge.exe 3488 msedge.exe 1220 msedge.exe 1220 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1220 msedge.exe 1220 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe 1220 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1220 wrote to memory of 1164 1220 msedge.exe 85 PID 1220 wrote to memory of 1164 1220 msedge.exe 85 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 208 1220 msedge.exe 86 PID 1220 wrote to memory of 3488 1220 msedge.exe 87 PID 1220 wrote to memory of 3488 1220 msedge.exe 87 PID 1220 wrote to memory of 3672 1220 msedge.exe 88 PID 1220 wrote to memory of 3672 1220 msedge.exe 88 PID 1220 wrote to memory of 3672 1220 msedge.exe 88 PID 1220 wrote to memory of 3672 1220 msedge.exe 88 PID 1220 wrote to memory of 3672 1220 msedge.exe 88 PID 1220 wrote to memory of 3672 1220 msedge.exe 88 PID 1220 wrote to memory of 3672 1220 msedge.exe 88 PID 1220 wrote to memory of 3672 1220 msedge.exe 88 PID 1220 wrote to memory of 3672 1220 msedge.exe 88 PID 1220 wrote to memory of 3672 1220 msedge.exe 88 PID 1220 wrote to memory of 3672 1220 msedge.exe 88 PID 1220 wrote to memory of 3672 1220 msedge.exe 88 PID 1220 wrote to memory of 3672 1220 msedge.exe 88 PID 1220 wrote to memory of 3672 1220 msedge.exe 88 PID 1220 wrote to memory of 3672 1220 msedge.exe 88 PID 1220 wrote to memory of 3672 1220 msedge.exe 88 PID 1220 wrote to memory of 3672 1220 msedge.exe 88 PID 1220 wrote to memory of 3672 1220 msedge.exe 88 PID 1220 wrote to memory of 3672 1220 msedge.exe 88 PID 1220 wrote to memory of 3672 1220 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\923d0838d54609b9b9644e721cc39014_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1fe446f8,0x7fff1fe44708,0x7fff1fe447182⤵PID:1164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,4617949181270722491,12436691996256353358,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:22⤵PID:208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,4617949181270722491,12436691996256353358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2604 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,4617949181270722491,12436691996256353358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:82⤵PID:3672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4617949181270722491,12436691996256353358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:12⤵PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4617949181270722491,12436691996256353358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:12⤵PID:3588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,4617949181270722491,12436691996256353358,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2500 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4392
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4584
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
- MD5 4b4f91fa1b362ba5341ecb2836438dea
- SHA1 9561f5aabed742404d455da735259a2c6781fa07
- SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
- MD5 eaa3db555ab5bc0cb364826204aad3f0
- SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
- SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 f7498fe5dd0f109fe0e77f7821eff4ba071f7afa5cf0afe1e74236f3edd6839d
- MD5 59447772feb227d93e60e3e93b3a41d4
- SHA1 9d9092c4f51636da6263a10dd3c3b9e9672a41f9
- SHA512 12318e859aa90ffe18b82c93760dd16c2023184218aad6b50e56b3566f5dfb317004d3340abc3c8be1a9d6015884ccfa6b0c900220ec1cd667343a312a1243f4
- SSDEEP 96:npkRT1qOEj0wpvWMoiVmdeHmQICtUWQyV+VDCziEwb:npkNDEj0GWMXzro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 f24ab059a8959755de5fa5b90189ba054c6ea8bd1c074b27be6c3ef89f9315d8
- MD5 6f22f2a72d50c45292b23f42e60c9775
- SHA1 39ab60f62831c868227eeadd91cb1ad0df0959bd
- SHA512 497e6b9748601124a203a09dac93810f020053abb3ceb3b34eed58c97a4a0734c7a781c7675f6fa2c531a45da644f341fed63d75bc877b389745963941899f5e
- SSDEEP 96:npk8T1qODj0wpvWMoiVmdeHmQICtUWQyV+VDCAiEwb:npkSDDj0GWMXzrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 a164642d33646701a0959ad7054113060a6a34e4cb2ccb829847892b08ad7423
- MD5 924390403ef35a2698d565491bb2f642
- SHA1 d95a1ad71690903c449ce55c0d2dba234d9ff072
- SHA512 0c8eb8f5ebb04a1f25e02fbfb8a78019b6d788e951d88b5f17a54585c986d8f6dbd3add6b2446fea3c63432d1a126f52f7b0ed32223c35b36b3ff0041df9ddbe
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupqFe2RUoIKbSfYOxhZHnqT5:A9iIxuERzA83h09RZxYqhfUxTHqTMTTQ
- MD5 SHA1 SHA512 SSDEEP