Analysis
- max time kernel
145s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 16:17
Static task
static1
Behavioral task
behavioral1
Sample
926a8bf4761584222480f3a0fe2ef8b8_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
926a8bf4761584222480f3a0fe2ef8b8_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 926a8bf4761584222480f3a0fe2ef8b8_JaffaCakes118.html
- Size 68KB
- Sample240603-trvr4adc67
- SHA256 b516246ea777c1816ef24da207675ab1ec23021d6eea41e0fa90760e01f3b39d
- MD5 926a8bf4761584222480f3a0fe2ef8b8
- SHA1 3ee3c707fc2a4fac1c805e497c92e8032c762eb0
- SHA512 55d8362601a0d6beaa28d1cd3aaf408815fee103468722c19db3ea53b165167c2bf395fae0acd0b1a0019df4f2184d22c86ca56de500a6c097a72f12654ee347
- SSDEEP 1536:qQ5tlefC4NK4tGbilXWggGFgo9AgbI6D6JRylRRxrSTtqXeasJRM:z5tMC4NK4tYilYG1K4RRxrSTtqXeasJS
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1908 msedge.exe 1908 msedge.exe 1044 msedge.exe 1044 msedge.exe 1340 msedge.exe 1340 msedge.exe 1340 msedge.exe 1340 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1044 msedge.exe 1044 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1044 wrote to memory of 4888 1044 msedge.exe 81 PID 1044 wrote to memory of 4888 1044 msedge.exe 81 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 3656 1044 msedge.exe 82 PID 1044 wrote to memory of 1908 1044 msedge.exe 83 PID 1044 wrote to memory of 1908 1044 msedge.exe 83 PID 1044 wrote to memory of 3096 1044 msedge.exe 84 PID 1044 wrote to memory of 3096 1044 msedge.exe 84 PID 1044 wrote to memory of 3096 1044 msedge.exe 84 PID 1044 wrote to memory of 3096 1044 msedge.exe 84 PID 1044 wrote to memory of 3096 1044 msedge.exe 84 PID 1044 wrote to memory of 3096 1044 msedge.exe 84 PID 1044 wrote to memory of 3096 1044 msedge.exe 84 PID 1044 wrote to memory of 3096 1044 msedge.exe 84 PID 1044 wrote to memory of 3096 1044 msedge.exe 84 PID 1044 wrote to memory of 3096 1044 msedge.exe 84 PID 1044 wrote to memory of 3096 1044 msedge.exe 84 PID 1044 wrote to memory of 3096 1044 msedge.exe 84 PID 1044 wrote to memory of 3096 1044 msedge.exe 84 PID 1044 wrote to memory of 3096 1044 msedge.exe 84 PID 1044 wrote to memory of 3096 1044 msedge.exe 84 PID 1044 wrote to memory of 3096 1044 msedge.exe 84 PID 1044 wrote to memory of 3096 1044 msedge.exe 84 PID 1044 wrote to memory of 3096 1044 msedge.exe 84 PID 1044 wrote to memory of 3096 1044 msedge.exe 84 PID 1044 wrote to memory of 3096 1044 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\926a8bf4761584222480f3a0fe2ef8b8_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1fe446f8,0x7fff1fe44708,0x7fff1fe447182⤵PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,16859141174819892502,1047203236949427258,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:3656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,16859141174819892502,1047203236949427258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,16859141174819892502,1047203236949427258,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:82⤵PID:3096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16859141174819892502,1047203236949427258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16859141174819892502,1047203236949427258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:4508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,16859141174819892502,1047203236949427258,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1340
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3520
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1776
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
- MD5 1ac52e2503cc26baee4322f02f5b8d9c
- SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
- SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
- MD5 b2a1398f937474c51a48b347387ee36a
- SHA1 922a8567f09e68a04233e84e5919043034635949
- SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 271B
- SHA256 cead4efc6e9a295335d405a1c5f98ba661d35c02ebd6daa4ec41a210b0b21bb9
- MD5 3f1f20e0d3c7967634ed6326747ee72e
- SHA1 b0b0b64c0e9e9fe7284f42ef464d4778cfccb88a
- SHA512 76c4d788f0585d2657640e4ef66d74fa7239fbda36d5b2885c28e35e854fac0f773e8d453bfd284afc2fb3ddb5890b164d018126bd4941177b98011dac880ea4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 72f4481eb226e349feae4b636af89b6b0e6d3cacfa0b6a39ac5a3c1e828773b0
- MD5 720b94552b7a7c130717f8d4c7e277bb
- SHA1 b53dc697edff40e1d21ae6cc2bd40ac75dedcf07
- SHA512 be5999c7ee83de7240c9799d9b910068f0eab3d2602ea41c5591ef2ba42b60c738d15b7eb89b763335753ab65db21030acb24c62b2427837f4a80d39c563df44
- SSDEEP 96:nrkml1+ymga9IQwpvWMoiVmdeHpCrJb0UWQyV+VDCziEwb:nrkG91aCQGWMXpGb0ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 a90ef4d94d589d6a535faca235677b93e4fad43d6cc397128a6bcea84265d64c
- MD5 9470a92b861a2a13b8cf5cc4c4ae1292
- SHA1 3cde0b072e80f5540c7fcf35d96374a9ed767528
- SHA512 de49cc2423848029faeb16f604aae60f7aece4c9bf1059694f096f67bcb954158aec67cf483109715d268f22bf120f3a5c55351c2cb4d1e32ecb073ff67c33bf
- SSDEEP 96:nrk9l1+y2ga9IQwpvWMoiVmde62pCrJb0UWQyV+VDCAiEwb:nrkz9laCQGWMK2pGb0rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 06d264d1c177287313a7369643db71253986f3d673a796ca9ac99ba6ce3441ed
- MD5 e639e754f408da1266c474a22a3252ea
- SHA1 b7a103f0ff47e03900a388673cd6b5931787bba8
- SHA512 9727c446558caa1193abd9ea11a33c12b20263a67bc7981d6f167a6944cc51a573a120eee504a8e5e7889111a6c4000790ca90547e7493d3474ec1b5cd264513
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuptkiWe2RUejf7ZB3z2OMDCa:A9iIxuERzA83h09RZxYtki4XzZBaOMWa
- MD5 SHA1 SHA512 SSDEEP