Analysis
- max time kernel
145s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 15:17
Static task
static1
Behavioral task
behavioral1
Sample
923d777ae426991c2f39e6f7b47efc71_JaffaCakes118.html
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
923d777ae426991c2f39e6f7b47efc71_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 923d777ae426991c2f39e6f7b47efc71_JaffaCakes118.html
- Size 188KB
- Sample240603-spa48sbg73
- SHA256 f78db56a04c0a295db09f5520d6c794ad2818ba13c5493a4231580e5373520ac
- MD5 923d777ae426991c2f39e6f7b47efc71
- SHA1 f46a6a10b0ed215182fc145e60ef0eac6a627d62
- SHA512 142c1260699c3f194e1352eaf5998544a7b06acdeefbf45c71315015563ac26eaca3431d229f5740157e5c8629a9b140a9aa208e20905f78d5a263257199d429
- SSDEEP 3072:VTJEau1VSc3LWe/3fcjyQ8SoJLc4UP13G4k5QhLpOatVNuXvpl1zAKtN4jLCHM2v:4J1Ete3PSotU3G4k5QhL8atVNu+22wOi
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 880 msedge.exe 880 msedge.exe 2200 msedge.exe 2200 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2200 wrote to memory of 3156 2200 msedge.exe 81 PID 2200 wrote to memory of 3156 2200 msedge.exe 81 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 4344 2200 msedge.exe 82 PID 2200 wrote to memory of 880 2200 msedge.exe 83 PID 2200 wrote to memory of 880 2200 msedge.exe 83 PID 2200 wrote to memory of 3124 2200 msedge.exe 84 PID 2200 wrote to memory of 3124 2200 msedge.exe 84 PID 2200 wrote to memory of 3124 2200 msedge.exe 84 PID 2200 wrote to memory of 3124 2200 msedge.exe 84 PID 2200 wrote to memory of 3124 2200 msedge.exe 84 PID 2200 wrote to memory of 3124 2200 msedge.exe 84 PID 2200 wrote to memory of 3124 2200 msedge.exe 84 PID 2200 wrote to memory of 3124 2200 msedge.exe 84 PID 2200 wrote to memory of 3124 2200 msedge.exe 84 PID 2200 wrote to memory of 3124 2200 msedge.exe 84 PID 2200 wrote to memory of 3124 2200 msedge.exe 84 PID 2200 wrote to memory of 3124 2200 msedge.exe 84 PID 2200 wrote to memory of 3124 2200 msedge.exe 84 PID 2200 wrote to memory of 3124 2200 msedge.exe 84 PID 2200 wrote to memory of 3124 2200 msedge.exe 84 PID 2200 wrote to memory of 3124 2200 msedge.exe 84 PID 2200 wrote to memory of 3124 2200 msedge.exe 84 PID 2200 wrote to memory of 3124 2200 msedge.exe 84 PID 2200 wrote to memory of 3124 2200 msedge.exe 84 PID 2200 wrote to memory of 3124 2200 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\923d777ae426991c2f39e6f7b47efc71_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9303d46f8,0x7ff9303d4708,0x7ff9303d47182⤵PID:3156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16324697905822115481,9306115755738082382,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:4344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,16324697905822115481,9306115755738082382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,16324697905822115481,9306115755738082382,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:82⤵PID:3124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16324697905822115481,9306115755738082382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:4820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16324697905822115481,9306115755738082382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:3984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16324697905822115481,9306115755738082382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2068 /prefetch:12⤵PID:1240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16324697905822115481,9306115755738082382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:12⤵PID:388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16324697905822115481,9306115755738082382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:4108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16324697905822115481,9306115755738082382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:12⤵PID:3724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16324697905822115481,9306115755738082382,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5884 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4864
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:8
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1964
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4628
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
- MD5 537815e7cc5c694912ac0308147852e4
- SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
- SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
- MD5 8b167567021ccb1a9fdf073fa9112ef0
- SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
- SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 408B
- SHA256 2eed817d7c3eee2a436f1b7b03df42ec964be7f535c9df3f1a8854608394ec25
- MD5 c1cf104df8c841ed76e91e516707e7e4
- SHA1 87f93dd866aca38f1f5a0835c21de0c6dbb21a2e
- SHA512 b258f7e60b893c6980ebfa087e332666d3979c5a0f0d20ca044ccefd34187c8215cb9dc503d5d56635a71d274a54f5a0b366be5bfa51ac6b100475d83dae04bc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 2KB
- SHA256 95988f2c31aeb16b43f36abe91420077cf81ac0de5dfe59e8c77b00f28315b46
- MD5 7ac023ce6a0626851d77fb360b8a7281
- SHA1 375ce65aea18b40a512330e3a72fe62fdfcff54e
- SHA512 7761b667f9ef8d3b7422aff9e2296978460474b635a8d0042b50beff0283c20ba1b3751abdfe11dea7e1ca23546115989112ad13704acd2f4e328f838505cdfe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 8KB
- SHA256 5413e986a21466f05a89b9306a1e9ee7c03a22f5f602b9393ba28fd60d9ca2b6
- MD5 3fbca56a335c79234afb27366796663a
- SHA1 ac30aab95a0ba929a84e7bea2875a6f39180a4ee
- SHA512 1699e1f25809a43ec5b92bf0e0cdf07d63a948c2a2acf7db4ade340c1c01fec54acb60fcc787ef30efea6942ef11ef253bffee8a9d31732f01d79f445aa06caa
- SSDEEP 192:nEk5c5z9GWM6meMvuaZYI7PYEroTEd1tatY2peyhrV:nEkYsWZaro489n
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 1212812a51f1f273c8bf2e12f02b5b98c2a80b9d8d50a98b7be4ff963193915a
- MD5 c651e005be3558a9e057694b2cceabd0
- SHA1 fd77e76127e164defe6bb5a72adc1a12f56a5478
- SHA512 9816db44629bfb2fd2aadfbf53af45fac0faaf7f0bec18af66df4ffbcab4d8bbb763a839aebc4f5d28cd566d730d4fe343a24e81b2592190bc5b12c7224753be
- SSDEEP 96:nEk8Z1m5D9wpvWMoiVmdeHpRQdyhUWQyV+VDCziEwb:nEk0c5D9GWMXpgyhro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 48eea14e95052a431e25a17740fa90a6f23fb3f15d11c04d71ffdc152836809a
- MD5 18bc2cf3a5bf1109c1d4d702c395baaf
- SHA1 e2d8eb39a70bacf5dede6e8bc5a002d57ef6a40a
- SHA512 631b6ca3349004df5124a565b84a097e86de1124e5a6e172c6c10b1fa52a61db813af8a9f3bbbb925568750beb49f7a8435f5b19fbfd73e08f41c09f5ddfb2c8
- SSDEEP 96:nEkHZ1m5D9wpvWMoiVmdeSXeMZ1t2pRQdyhUWQyV+VDCAiEwb:nEk5c5D9GWM6eMZ1t2pgyhrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 558014cb129fe9279435889cff804b94723602e0b3d604da3fef6eca70b78da9
- MD5 e25365c59a205ec671b7d8e8c7c259a7
- SHA1 276f93827cb41d01e81861cc0f667997370c154a
- SHA512 fbf41e5f23c78336f4c7443d6b2e01ca91430dfe566d2442cebb48dc1502d9ef258fd5426c3c855f7fc1eb828c3c5b13ac3161c4dd95170edea477ca4e0b3f63
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupROe2RUvqTJ3z2OMDCRHqlF:A9iIxuERzA83h09RZxYRQfJaOMWRHqlF
- MD5 SHA1 SHA512 SSDEEP