Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 16:13
Static task
static1
Behavioral task
behavioral1
Sample
92675953a1e6bc3c2972a3807a0c0365_JaffaCakes118.html
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
92675953a1e6bc3c2972a3807a0c0365_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 92675953a1e6bc3c2972a3807a0c0365_JaffaCakes118.html
- Size 159KB
- Sample240603-tpcthadb83
- SHA256 aac3bd17064f83aa9f319d35b2be5a7efaef7f17cc23e393204c8e71dc4f8e32
- MD5 92675953a1e6bc3c2972a3807a0c0365
- SHA1 326b206d9fae2e699af46164b264b9ff41d4e26c
- SHA512 3b710ffa2c8e172833afe7357a7c9037df787e4c5c1cfcf2112f2d266d46e4d5485a88c413557053ac2c165721666146c5f1c637ad575086f49e918c61985c13
- SSDEEP 1536:SiunAZj6lhcxv1yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:SifDv1yfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3508 msedge.exe 3508 msedge.exe 5036 msedge.exe 5036 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5036 msedge.exe 5036 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5036 wrote to memory of 5092 5036 msedge.exe 82 PID 5036 wrote to memory of 5092 5036 msedge.exe 82 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 2192 5036 msedge.exe 83 PID 5036 wrote to memory of 3508 5036 msedge.exe 84 PID 5036 wrote to memory of 3508 5036 msedge.exe 84 PID 5036 wrote to memory of 5080 5036 msedge.exe 85 PID 5036 wrote to memory of 5080 5036 msedge.exe 85 PID 5036 wrote to memory of 5080 5036 msedge.exe 85 PID 5036 wrote to memory of 5080 5036 msedge.exe 85 PID 5036 wrote to memory of 5080 5036 msedge.exe 85 PID 5036 wrote to memory of 5080 5036 msedge.exe 85 PID 5036 wrote to memory of 5080 5036 msedge.exe 85 PID 5036 wrote to memory of 5080 5036 msedge.exe 85 PID 5036 wrote to memory of 5080 5036 msedge.exe 85 PID 5036 wrote to memory of 5080 5036 msedge.exe 85 PID 5036 wrote to memory of 5080 5036 msedge.exe 85 PID 5036 wrote to memory of 5080 5036 msedge.exe 85 PID 5036 wrote to memory of 5080 5036 msedge.exe 85 PID 5036 wrote to memory of 5080 5036 msedge.exe 85 PID 5036 wrote to memory of 5080 5036 msedge.exe 85 PID 5036 wrote to memory of 5080 5036 msedge.exe 85 PID 5036 wrote to memory of 5080 5036 msedge.exe 85 PID 5036 wrote to memory of 5080 5036 msedge.exe 85 PID 5036 wrote to memory of 5080 5036 msedge.exe 85 PID 5036 wrote to memory of 5080 5036 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\92675953a1e6bc3c2972a3807a0c0365_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7e4646f8,0x7ffe7e464708,0x7ffe7e4647182⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,687926540124202586,17624166060486054548,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:2192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,687926540124202586,17624166060486054548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,687926540124202586,17624166060486054548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:82⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,687926540124202586,17624166060486054548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:1944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,687926540124202586,17624166060486054548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:4620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,687926540124202586,17624166060486054548,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2344 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4700
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4592
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
- MD5 537815e7cc5c694912ac0308147852e4
- SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
- SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
- MD5 8b167567021ccb1a9fdf073fa9112ef0
- SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
- SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 2be15bae093bc07db4886bd9f78c19d7bec1e59366a0d67f82ac2464e96c62cd
- MD5 d224c45486b1adb047c5665384124541
- SHA1 8fd5874420ccc22ab1790af58114dbb4e5d3e096
- SHA512 3022abc9a38524792e6d3c797f3db942b6e2516c6c027c24654220d291f23f36837674243e6d0a91c817d85e00531c937d4209bff57a7b01547ff935596e1188
- SSDEEP 96:ndkmD1Xd3Qr9wpvWMoiVmdeHpRQe2UWQyV+VDCziEwb:ndksP3Qr9GWMXpP2ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 b0759abd4c32d8d5e2f9755788209d849c7f1103073a4ef1e81327cfe4b62049
- MD5 9ed618cea88d0b2558f2a757c2cf15a5
- SHA1 675d05cf73706de3a4b9ea8597fab9d578fa8894
- SHA512 79a9022eb9b350fa0801c9a0a899812320effb15660102746912809602358f544553da44d7a0e7135cf517f10aabea42a07a0d97c82af324b31f53bb6f20d015
- SSDEEP 96:ndk9D1Xd3QK9wpvWMoiVmdeHpRQe2UWQyV+VDCAiEwb:ndkJP3QK9GWMXpP2rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 6ff37521ba48b5de29d5c321331313bc10084c82cce8e4782fab3b1f192f81c8
- MD5 99baa32e01e4fe63a64523ed88d96548
- SHA1 2734cf5f9fcd9286dd7b62a496064f74741692f7
- SHA512 0622f2c35445e4a23ff2faa4cbda7452433c3aab30de2afb7ab567bb2cbb57f50d85361348fbb97fc3b0f6c44587ba5f62463591593f6f6d790f682e1eb9166e
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuptVe2RUsqTFT3z2OMDCRHqY:A9iIxuERzA83h09RZxYtRSJaOMWRHqle
- MD5 SHA1 SHA512 SSDEEP