Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 15:22
Static task
static1
Behavioral task
behavioral1
Sample
923fc22610094b83f48a762a6606638b_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
923fc22610094b83f48a762a6606638b_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 923fc22610094b83f48a762a6606638b_JaffaCakes118.html
- Size 40KB
- Sample240603-sr38ssbh45
- SHA256 3b8571ae28b8f111abe468326062f0195afc98e677576a83426cdf9329cff127
- MD5 923fc22610094b83f48a762a6606638b
- SHA1 1a72de858a5aa4773cdcee3d6700ac9fc48d670c
- SHA512 e48161fde0d313f5d0cfc71461390eb6f84c2b5061172cb2552d6bb5f36bbf84b61afe82d77bdd7254846d2559f489da45bb61bcaa7d200f3d6df06aa30a9a9b
- SSDEEP 384:vQ/52xZgHucyElQDWQKiGdK9eFKFjdldApOPKPc04fnFxc:IQKRdKDe
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3576 msedge.exe 3576 msedge.exe 3832 msedge.exe 3832 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 4280 identity_helper.exe 4280 identity_helper.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3832 wrote to memory of 2260 3832 msedge.exe 81 PID 3832 wrote to memory of 2260 3832 msedge.exe 81 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 5052 3832 msedge.exe 82 PID 3832 wrote to memory of 3576 3832 msedge.exe 83 PID 3832 wrote to memory of 3576 3832 msedge.exe 83 PID 3832 wrote to memory of 3716 3832 msedge.exe 84 PID 3832 wrote to memory of 3716 3832 msedge.exe 84 PID 3832 wrote to memory of 3716 3832 msedge.exe 84 PID 3832 wrote to memory of 3716 3832 msedge.exe 84 PID 3832 wrote to memory of 3716 3832 msedge.exe 84 PID 3832 wrote to memory of 3716 3832 msedge.exe 84 PID 3832 wrote to memory of 3716 3832 msedge.exe 84 PID 3832 wrote to memory of 3716 3832 msedge.exe 84 PID 3832 wrote to memory of 3716 3832 msedge.exe 84 PID 3832 wrote to memory of 3716 3832 msedge.exe 84 PID 3832 wrote to memory of 3716 3832 msedge.exe 84 PID 3832 wrote to memory of 3716 3832 msedge.exe 84 PID 3832 wrote to memory of 3716 3832 msedge.exe 84 PID 3832 wrote to memory of 3716 3832 msedge.exe 84 PID 3832 wrote to memory of 3716 3832 msedge.exe 84 PID 3832 wrote to memory of 3716 3832 msedge.exe 84 PID 3832 wrote to memory of 3716 3832 msedge.exe 84 PID 3832 wrote to memory of 3716 3832 msedge.exe 84 PID 3832 wrote to memory of 3716 3832 msedge.exe 84 PID 3832 wrote to memory of 3716 3832 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\923fc22610094b83f48a762a6606638b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8b8946f8,0x7ffc8b894708,0x7ffc8b8947182⤵PID:2260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,10714488982259684639,9222273002488264352,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,10714488982259684639,9222273002488264352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,10714488982259684639,9222273002488264352,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:82⤵PID:3716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10714488982259684639,9222273002488264352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10714488982259684639,9222273002488264352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,10714488982259684639,9222273002488264352,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3084 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,10714488982259684639,9222273002488264352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:82⤵PID:3808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,10714488982259684639,9222273002488264352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10714488982259684639,9222273002488264352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2968 /prefetch:12⤵PID:1804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10714488982259684639,9222273002488264352,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:12⤵PID:3388
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2084
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
- MD5 1ac52e2503cc26baee4322f02f5b8d9c
- SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
- SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
- MD5 b2a1398f937474c51a48b347387ee36a
- SHA1 922a8567f09e68a04233e84e5919043034635949
- SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5e54701e-b625-4b00-98d4-f5b6e8f0f9b4.tmp
- Size 6KB
- SHA256 00fcf6c46e9e9606329a165edfc54d34eab96c9c3dac043cddfabc520c7f2ef0
- MD5 8275fb8791a5719720a50fd68373bd21
- SHA1 428e12246d4e34cb1efa6bdc4b031fcff8277ccd
- SHA512 155562a775207ae9ec74c511e56978b0b32b9b4a71af3d027dbcabda14d3ee0376353155ca1c50d9ce1f4b747f2191c62e3e860a16310a316098a301175e2be5
- SSDEEP 96:nkk3xQ1bega9IQwpvWMoiVmdeHpCrQbxUWQyV+VDCAiEwb:nkk+xNaCQGWMXprbxrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 98b8aa966498fbbee41c7a857994602c76bd70e89f2ce012a441f62170d2f826
- MD5 0511bf65a3846bffd3d68ef3019cdb53
- SHA1 f2ee1a469e07571fa9770b2496c85d09e874a7c3
- SHA512 de5080b3d93a2464256baee8a419349571940e95a2d67d8d747c68234313f2a6d187be04c65356a28c762bf6e0d19c3cf26c6fc8369409a5bb2fbd153bdd672e
- SSDEEP 96:nkkMxQ1bega9IQwpvWMoiVmdeHpCrQbxUWQyV+VDCziEwb:nkkjxNaCQGWMXprbxro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 d0e2dcce817f7b5bcda55b88115c87eeda78d4fe206045afe454828d0b2a1f39
- MD5 a55f3119d480df6bee461de08fe272c4
- SHA1 6c962af6003ab9fed5808f285ebc64ead946feb6
- SHA512 ca68c1051ef5ce16e4824a0c60588cb6f287a06c06a1404c9c7585b3983d12ca89e649f04282c4ac02f3c1e8c693115ccda7a8913df99f0dc410253bcc5e415c
- SSDEEP 96:nkk3xQ1bUga9IQwpvWMoiVmdeHpCrQbxUWQyV+VDCAiEwb:nkk+x3aCQGWMXprbxrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 25d802b202aa11afbe07f7d9d5c3f8a47cdf5da921c8fa17548b27adcbfe491f
- MD5 7710d0630e923afb0c62582cf89ebf8a
- SHA1 68dc868cbfd988a76abc37b28b02469e141a3b6e
- SHA512 ea4df895ebdd8e983a1ce9bb9cab4d506d874cf73d2b953dd67c514bc0356a6cc5dd8d3796ff5b7289b85414f3e39f5a7f7be7936ff4ef042237357898ee5ca5
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup8kse2RUtajf7Z73z2OMDC2:A9iIxuERzA83h09RZxY8kyAmzZ7aOMW2
- MD5 SHA1 SHA512 SSDEEP