Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
04/06/2024, 23:46
Static task
static1
Behavioral task
behavioral1
Sample
96a8d0c93e418f76d2ecbbc8f800a2bd_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
96a8d0c93e418f76d2ecbbc8f800a2bd_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 96a8d0c93e418f76d2ecbbc8f800a2bd_JaffaCakes118.html
- Size 184KB
- Sample240604-3sl11sfe5t
- SHA256 b160915cc355bc9dbd4f9d8fca06447b8b69b5463e360f756838ec26e3c1af7d
- MD5 96a8d0c93e418f76d2ecbbc8f800a2bd
- SHA1 9e8d93b4071c4954b49ef1d18f9ee46f123d7df2
- SHA512 f51f91624fd3acc62bc3e99f60ad35613931a613fdf312aaff9b9f60b35250aa0a5623a5cf5c9298e7b081f3bc3c66b88249d8f5db9ecfe1abb3d75488fd5479
- SSDEEP 3072:pnyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFis:osMYod+X3oI+Yn86/U9jFis
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2352 msedge.exe 2352 msedge.exe 4236 msedge.exe 4236 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4236 msedge.exe 4236 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4236 wrote to memory of 4436 4236 msedge.exe 83 PID 4236 wrote to memory of 4436 4236 msedge.exe 83 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2128 4236 msedge.exe 84 PID 4236 wrote to memory of 2352 4236 msedge.exe 85 PID 4236 wrote to memory of 2352 4236 msedge.exe 85 PID 4236 wrote to memory of 3860 4236 msedge.exe 86 PID 4236 wrote to memory of 3860 4236 msedge.exe 86 PID 4236 wrote to memory of 3860 4236 msedge.exe 86 PID 4236 wrote to memory of 3860 4236 msedge.exe 86 PID 4236 wrote to memory of 3860 4236 msedge.exe 86 PID 4236 wrote to memory of 3860 4236 msedge.exe 86 PID 4236 wrote to memory of 3860 4236 msedge.exe 86 PID 4236 wrote to memory of 3860 4236 msedge.exe 86 PID 4236 wrote to memory of 3860 4236 msedge.exe 86 PID 4236 wrote to memory of 3860 4236 msedge.exe 86 PID 4236 wrote to memory of 3860 4236 msedge.exe 86 PID 4236 wrote to memory of 3860 4236 msedge.exe 86 PID 4236 wrote to memory of 3860 4236 msedge.exe 86 PID 4236 wrote to memory of 3860 4236 msedge.exe 86 PID 4236 wrote to memory of 3860 4236 msedge.exe 86 PID 4236 wrote to memory of 3860 4236 msedge.exe 86 PID 4236 wrote to memory of 3860 4236 msedge.exe 86 PID 4236 wrote to memory of 3860 4236 msedge.exe 86 PID 4236 wrote to memory of 3860 4236 msedge.exe 86 PID 4236 wrote to memory of 3860 4236 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\96a8d0c93e418f76d2ecbbc8f800a2bd_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6b7d46f8,0x7ffd6b7d4708,0x7ffd6b7d47182⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,13291299412357304072,757454549801734793,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:2128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,13291299412357304072,757454549801734793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,13291299412357304072,757454549801734793,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:82⤵PID:3860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13291299412357304072,757454549801734793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13291299412357304072,757454549801734793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:3676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,13291299412357304072,757454549801734793,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4876 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3536
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3264
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
- MD5 56641592f6e69f5f5fb06f2319384490
- SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
- SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
- MD5 612a6c4247ef652299b376221c984213
- SHA1 d306f3b16bde39708aa862aee372345feb559750
- SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 990b8270b286ebf777ef5de25e07285bfbf6e5e1ba4262948f8a8acf61429150
- MD5 b602c3bd0441538d919920102853e4af
- SHA1 5f0258f79c4ac60174ca2ba4531b550898b2d53a
- SHA512 a08d93f565358d1af064c6ef2911f2a704fb0a552a347d5f47d1cbf5c31cc60a666394679a19ab7ee98c373becb96a5dcdd515cd213c4852f4e59b1437ca7595
- SSDEEP 96:nS0lkfi0m1en2wpvWMoiVmdeHk4DUWQyV+VDCziEwb:nS0lka0mYn2GWMX9ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 6650f3281085c0db509fe4adbbee4edaa2117dcdfa34949f150202480a3b3dc8
- MD5 15a1e996862a9cd5768680b487fc533a
- SHA1 2be6ba9681e20a8a42459a1956fd4a63686dcb7f
- SHA512 9c778d6dead0fbb276551239a5c606ad2344c93d59643b79334a586575fbba923e52e2c0eda376bc2f4c62baa3d7ac62079dddc362188bfcd92572b1b4c2a77d
- SSDEEP 96:nS0lkWi0m1em2wpvWMoiVmdeHk4DUWQyV+VDCAiEwb:nS0lkD0mYm2GWMX9rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 a6f1cce0ac767063cded58eb2ba1eac078249bed3017e1e1e3a8b7ac589afb43
- MD5 d7297a9f921917e38f1c43d93d86821a
- SHA1 594572ca4790f143d6c1476a8103a81fd3cba20e
- SHA512 4cb1dc76fab3d74b2615ccf490e87dded2fa06aac841a607ae4f951a6a9ac6476b084651d291df10d77dda41305ccb74f3c261e8ca8efdfa9f92b07a1f9697f8
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupA0Le2RUF09y4VB3z2OMDCo:A9iIxuERzA83h09RZxYdb3DBaOMWRHqR
- MD5 SHA1 SHA512 SSDEEP