Analysis
- max time kernel
145s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
04/06/2024, 07:32
Static task
static1
Behavioral task
behavioral1
Sample
9403cb71b068d2b6036b777e2058d8f5_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
9403cb71b068d2b6036b777e2058d8f5_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 9403cb71b068d2b6036b777e2058d8f5_JaffaCakes118.html
- Size 221KB
- Sample240604-jc3t2saa86
- SHA256 e1e7e39aa9ee2ffb34dea204206851d6f09c0dff375ecb109ca361cdb0fa54b2
- MD5 9403cb71b068d2b6036b777e2058d8f5
- SHA1 b446b8291c75ab4364232d97168a3ee9edca120f
- SHA512 07ee0bfb66cd3f9fcfcbb64fabe669ba4560d32946886431bb2b4bd5e7348612309fe7000db6c18174e1a27f2dfc031879ce65c64fed44b1fdb0924907cc35cc
- SSDEEP 3072:e0JPlXoqIrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJ2:/Xo3z9VxLY7iAVLTBQJl2
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3160 msedge.exe 3160 msedge.exe 4456 msedge.exe 4456 msedge.exe 4400 msedge.exe 4400 msedge.exe 4400 msedge.exe 4400 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4456 msedge.exe 4456 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4456 wrote to memory of 3472 4456 msedge.exe 82 PID 4456 wrote to memory of 3472 4456 msedge.exe 82 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 1596 4456 msedge.exe 83 PID 4456 wrote to memory of 3160 4456 msedge.exe 84 PID 4456 wrote to memory of 3160 4456 msedge.exe 84 PID 4456 wrote to memory of 4796 4456 msedge.exe 85 PID 4456 wrote to memory of 4796 4456 msedge.exe 85 PID 4456 wrote to memory of 4796 4456 msedge.exe 85 PID 4456 wrote to memory of 4796 4456 msedge.exe 85 PID 4456 wrote to memory of 4796 4456 msedge.exe 85 PID 4456 wrote to memory of 4796 4456 msedge.exe 85 PID 4456 wrote to memory of 4796 4456 msedge.exe 85 PID 4456 wrote to memory of 4796 4456 msedge.exe 85 PID 4456 wrote to memory of 4796 4456 msedge.exe 85 PID 4456 wrote to memory of 4796 4456 msedge.exe 85 PID 4456 wrote to memory of 4796 4456 msedge.exe 85 PID 4456 wrote to memory of 4796 4456 msedge.exe 85 PID 4456 wrote to memory of 4796 4456 msedge.exe 85 PID 4456 wrote to memory of 4796 4456 msedge.exe 85 PID 4456 wrote to memory of 4796 4456 msedge.exe 85 PID 4456 wrote to memory of 4796 4456 msedge.exe 85 PID 4456 wrote to memory of 4796 4456 msedge.exe 85 PID 4456 wrote to memory of 4796 4456 msedge.exe 85 PID 4456 wrote to memory of 4796 4456 msedge.exe 85 PID 4456 wrote to memory of 4796 4456 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9403cb71b068d2b6036b777e2058d8f5_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9924846f8,0x7ff992484708,0x7ff9924847182⤵PID:3472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,15898802317457625550,7186651892297350697,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:22⤵PID:1596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,15898802317457625550,7186651892297350697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,15898802317457625550,7186651892297350697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:82⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,15898802317457625550,7186651892297350697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:1564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,15898802317457625550,7186651892297350697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,15898802317457625550,7186651892297350697,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4008 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4400
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:336
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
- MD5 56641592f6e69f5f5fb06f2319384490
- SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
- SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
- MD5 612a6c4247ef652299b376221c984213
- SHA1 d306f3b16bde39708aa862aee372345feb559750
- SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 111B
- SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
- MD5 807419ca9a4734feaf8d8563a003b048
- SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
- SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 184B
- SHA256 4a7a4ff4e61b7ee8d3c633660ecd135323d40b53fbe17e7129efbb0c62f66e3a
- MD5 66467a425b7af78374ba968203f1f538
- SHA1 26de9275af79ff1689a9036bb94dcbe0efb043ed
- SHA512 96a16d6d3f12d4df2f068e71736a42c445884fe8e942fcb2ece3e70f2f56dbe8192412db1068e9577d9c38acb265d07a2b0430ccf562dbdace0eb7d52e73ade4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 c23020391d7bf8dd6571e8ba8f25cce9f8584006f5708de25eadf84e0f10f97d
- MD5 fb53017f108586b44354d1dd66a20f4f
- SHA1 7cba362c5b89a531b693074b7eb5339898e24e84
- SHA512 38137ab7731001e44944c5d1f968b9551cb005983499e8c7080b9e3dbdc1465f433fafc190dee3354e06e2bf9a5e39b6d27f55b2b6a520f229cc291ce0cf937e
- SSDEEP 96:nkkRb1Z72wpvWMoiVmdeHk4wUWQyV+VDCziEwb:nkkp/72GWMXGro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 62eecdd7396661b644b515799ad072758115fe259b3088950a2c4cd76e80d772
- MD5 d801fd972a4a5eba0e5fca2533736e49
- SHA1 aa7b378edadea90427459a25cdbc8932f0546da7
- SHA512 900acf711b7d298ea47c110bd9462336e37ad3761331e5b7c695e4ee2b1796e9b066a0bec4fdeb661ca7eaa0a7b56e92f1cec310e7218332e79c4470d332f871
- SSDEEP 96:nkk8b1Z72wpvWMoiVmde71qk4wUWQyV+VDCAiEwb:nkkS/72GWMr1qGrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 6eaa2b7c9201136bbd35fbce1e7f265f8d9512361e6bc1a167ca68a0aec49251
- MD5 8da9070bb547fec0f8e6a3b79e32e268
- SHA1 686b81c95028f00abbef2e761c159e704077c270
- SHA512 7121cc60115512f6a359948ce5091c0251d921306e57aa00aff6d3c2c325d2508dda82f8b8a2def57f796cd9d5d63bf8ed87110fb463674a0174d2ca7cf9425b
- SSDEEP 96:nkk8b1ZK2wpvWMoiVmde71qk4wUWQyV+VDCAiEwb:nkkS/K2GWMr1qGrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 9eb3309a19a2ddfae4cb1d962f72d21915a6919abafad1d273eeba7ede3c13ea
- MD5 b2bccb1f47677920f53e4d06da531b9e
- SHA1 e8d130f17f0273c8606f049d8798d6e74a30444a
- SHA512 58fa80d3f341a9bde7ac76aef90e6564eeb8d9310b84657041a7a685d811c25d4afc0c1534c34e2f62f72e2974f3d08f4f7872081f5f758c3ab66f48a0f0cc84
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupsYe2RU1y4VQ3z2OMDCRHqT:A9iIxuERzA83h09RZxY9IQaOMWRHqlW+
- MD5 SHA1 SHA512 SSDEEP