Analysis
- max time kernel
149s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
05/06/2024, 00:43
Static task
static1
Behavioral task
behavioral1
Sample
96cae5054420a73d1633923da629a231_JaffaCakes118.html
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
96cae5054420a73d1633923da629a231_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 96cae5054420a73d1633923da629a231_JaffaCakes118.html
- Size 22KB
- Sample240605-a3e18shf98
- SHA256 eba5e9bdc450d2cc069f4b1083ab7f527a01cbfd77966f80684382a71dcdd8f6
- MD5 96cae5054420a73d1633923da629a231
- SHA1 9ad4fa16ab16c10ffbeb78f9d447a4a73e358daa
- SHA512 429a99e94acc0a4f8ec3a0654ea52a705b0c191d2880baa973753ac3c9230d8010c1cdcecb119b4a69138ed3dce34706cbb02098bcf240305ab70eac376754a7
- SSDEEP 192:SIM3t0I5fo9cKivXQWxZxdkVSoAIv4hzUnjBhDV82qDB8:SIMd0I5nvHFsvDuxDB8
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5016 msedge.exe 5016 msedge.exe 1148 msedge.exe 1148 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1148 msedge.exe 1148 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe 1148 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1148 wrote to memory of 216 1148 msedge.exe 83 PID 1148 wrote to memory of 216 1148 msedge.exe 83 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 2248 1148 msedge.exe 84 PID 1148 wrote to memory of 5016 1148 msedge.exe 85 PID 1148 wrote to memory of 5016 1148 msedge.exe 85 PID 1148 wrote to memory of 2532 1148 msedge.exe 86 PID 1148 wrote to memory of 2532 1148 msedge.exe 86 PID 1148 wrote to memory of 2532 1148 msedge.exe 86 PID 1148 wrote to memory of 2532 1148 msedge.exe 86 PID 1148 wrote to memory of 2532 1148 msedge.exe 86 PID 1148 wrote to memory of 2532 1148 msedge.exe 86 PID 1148 wrote to memory of 2532 1148 msedge.exe 86 PID 1148 wrote to memory of 2532 1148 msedge.exe 86 PID 1148 wrote to memory of 2532 1148 msedge.exe 86 PID 1148 wrote to memory of 2532 1148 msedge.exe 86 PID 1148 wrote to memory of 2532 1148 msedge.exe 86 PID 1148 wrote to memory of 2532 1148 msedge.exe 86 PID 1148 wrote to memory of 2532 1148 msedge.exe 86 PID 1148 wrote to memory of 2532 1148 msedge.exe 86 PID 1148 wrote to memory of 2532 1148 msedge.exe 86 PID 1148 wrote to memory of 2532 1148 msedge.exe 86 PID 1148 wrote to memory of 2532 1148 msedge.exe 86 PID 1148 wrote to memory of 2532 1148 msedge.exe 86 PID 1148 wrote to memory of 2532 1148 msedge.exe 86 PID 1148 wrote to memory of 2532 1148 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\96cae5054420a73d1633923da629a231_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4dd946f8,0x7ffd4dd94708,0x7ffd4dd947182⤵PID:216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11864089163505859082,605317729061651894,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:22⤵PID:2248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,11864089163505859082,605317729061651894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,11864089163505859082,605317729061651894,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:82⤵PID:2532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11864089163505859082,605317729061651894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:2020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11864089163505859082,605317729061651894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:1660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11864089163505859082,605317729061651894,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2680 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3232
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4264
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
- MD5 4b4f91fa1b362ba5341ecb2836438dea
- SHA1 9561f5aabed742404d455da735259a2c6781fa07
- SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
- MD5 eaa3db555ab5bc0cb364826204aad3f0
- SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
- SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 f7ffac2427bf5b52e868eefcb567f1764b47b0f29a2fa3eed12a21fc8c2bb9ae
- MD5 91b28dbbae47cb7fd6c853728b7dc01d
- SHA1 94caf85e6dbc99e8a2277dbb5a913b83c88c00dd
- SHA512 c64fd79c2ce7aa937b276fa88cd7f8af238f397aeaa7f88faefd5ca6328fd3aa64b64158986d164a34aebdc3a924cc701e1a593c6d24c520c7de2088d15e6667
- SSDEEP 96:n8kc81ptJaSj0wpvWMoiVmdeHmQIYUWQyV+VDCAiEwb:n8kpztJaSj0GWMXnrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 264c96b01c3d0f7cf90653c8341fedac371a45557bb0703671b14cfe2dd233da
- MD5 f77264ae79481009ca7d93c06a14d4f0
- SHA1 193a4b960d7daf58b18a0cefc81042eba467b76b
- SHA512 677753bdb4368d52d9f119ce6b5ba756b1e9b1f2ebd58ea05da7268dcb95cbce369b7e92262bc4a31b09a6b7ac793e370ff152ca252504a308bd4fcef5410936
- SSDEEP 96:n8kx81ptJaxj0wpvWMoiVmdeHmQIYUWQyV+VDCziEwb:n8k+ztJaxj0GWMXnro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 f51c369985da0d29282924dee0e105974ceab7a7d88fbf08343871e95ea9e4ce
- MD5 16017a213b0727fe95c8cc627f2308cf
- SHA1 ddbd3e52692dab7941d6a839bf38c82926ce42c4
- SHA512 471b4f0630a8ac00bc7deb4d62bdb3f848e56c8434bae4ceff22f47ebc08a0d1bff8af7059108040882584afc449c53d444245c9c589ecd273d8930544ae2f8c
- SSDEEP 96:n8kc81ptJaxj0wpvWMoiVmdeHmQIYUWQyV+VDCAiEwb:n8kpztJaxj0GWMXnrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 cf10a150bf9651ae27acab54d31f72140f94e8fe8132fcdec35354211e7c71eb
- MD5 ccb26e793300136fc47002d0db1f27d8
- SHA1 b6f8f13628ae5e386a082b11623e0a36b91a0ab5
- SHA512 22441796283469ae14769bf6f4a85ed72f594be6358da02ef717c79ec9f534a72f58ff4f7953fedf0f82d7cdc558c403601976b007c0ba840833609ea0a9d00e
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupeue2RUvIKbMfYOxhZHnqTe:A9iIxuERzA83h09RZxYewQaxTHqTMTOM
- MD5 SHA1 SHA512 SSDEEP