Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
10/06/2024, 04:45
Static task
static1
Behavioral task
behavioral1
Sample
9a62e5fe372e651b376161b01e7ec1cb_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
9a62e5fe372e651b376161b01e7ec1cb_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 9a62e5fe372e651b376161b01e7ec1cb_JaffaCakes118.html
- Size 100KB
- Sample240610-fdft5acc3w
- SHA256 6a43fec73df14419662ab8b047f4db84f066ffc7642752c19c2bd43eeabcee22
- MD5 9a62e5fe372e651b376161b01e7ec1cb
- SHA1 4ff45fd5103008121c9c6eeb4b265c6477c3b76a
- SHA512 01c9ed06fb756990ec7c2d672f142e99acf94f91dca5d57b4e49fbf1ceddfe26de4d683fe42d4e5fedd749b1879b6636448e43c1137c831915ca037565eaa36e
- SSDEEP 1536:cdCy0PRsg2o4yUapr9gYAx0a8WQwoo0l5wj+oB4IE5/Hwhy1W7y8WUyvdzeAG/N6:cdCsgjUah9gYAkU+2jhEzPG/HwMc
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3732 msedge.exe 3732 msedge.exe 1288 msedge.exe 1288 msedge.exe 4104 msedge.exe 4104 msedge.exe 4104 msedge.exe 4104 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1288 msedge.exe 1288 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1288 wrote to memory of 1620 1288 msedge.exe 82 PID 1288 wrote to memory of 1620 1288 msedge.exe 82 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 1360 1288 msedge.exe 83 PID 1288 wrote to memory of 3732 1288 msedge.exe 84 PID 1288 wrote to memory of 3732 1288 msedge.exe 84 PID 1288 wrote to memory of 1948 1288 msedge.exe 85 PID 1288 wrote to memory of 1948 1288 msedge.exe 85 PID 1288 wrote to memory of 1948 1288 msedge.exe 85 PID 1288 wrote to memory of 1948 1288 msedge.exe 85 PID 1288 wrote to memory of 1948 1288 msedge.exe 85 PID 1288 wrote to memory of 1948 1288 msedge.exe 85 PID 1288 wrote to memory of 1948 1288 msedge.exe 85 PID 1288 wrote to memory of 1948 1288 msedge.exe 85 PID 1288 wrote to memory of 1948 1288 msedge.exe 85 PID 1288 wrote to memory of 1948 1288 msedge.exe 85 PID 1288 wrote to memory of 1948 1288 msedge.exe 85 PID 1288 wrote to memory of 1948 1288 msedge.exe 85 PID 1288 wrote to memory of 1948 1288 msedge.exe 85 PID 1288 wrote to memory of 1948 1288 msedge.exe 85 PID 1288 wrote to memory of 1948 1288 msedge.exe 85 PID 1288 wrote to memory of 1948 1288 msedge.exe 85 PID 1288 wrote to memory of 1948 1288 msedge.exe 85 PID 1288 wrote to memory of 1948 1288 msedge.exe 85 PID 1288 wrote to memory of 1948 1288 msedge.exe 85 PID 1288 wrote to memory of 1948 1288 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9a62e5fe372e651b376161b01e7ec1cb_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea6ed46f8,0x7ffea6ed4708,0x7ffea6ed47182⤵PID:1620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8008698462826378375,12909844443193787879,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵PID:1360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,8008698462826378375,12909844443193787879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,8008698462826378375,12909844443193787879,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8008698462826378375,12909844443193787879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:1224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8008698462826378375,12909844443193787879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:3756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8008698462826378375,12909844443193787879,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4104
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4732
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
- MD5 a8e767fd33edd97d306efb6905f93252
- SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
- SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
- MD5 439b5e04ca18c7fb02cf406e6eb24167
- SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
- SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 1KB
- SHA256 ddd8dce73e439325dc13345f14b76effad4eb4415f913e6ca556c8735181a37a
- MD5 fd7abe20d49db076ce8d82a1486eb7c7
- SHA1 0d9af84c721b1e67b33a1bffa69e7161bddaac03
- SHA512 462b2372fc9bc3fbf8bc3c67686eefd51685a1d038c5dda07724ee8103ff4fe661c90a115343a065dd8cab9c9d5f806760f4f372a14e73cdcdadf145ec670fe4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 12bb9bab3d3e8a95cb8f1840f5e311335e32c041f45c3c22adbd2b3d1d9772fa
- MD5 324e284257ea9785b4daafbbcd194afb
- SHA1 eee89435b0fab80fb19b2342253c45053feb0e55
- SHA512 c6c9ac57b46f0d55d34e263bcc1452a5033f70357dc9f6e634421847c022f020d9df8d6d6be545686bf512c6b21990ae6d1995d1cbfd8176565acc60c47b73e4
- SSDEEP 96:nDkhaa18BwpvWMoiVmdeHBrz3nqiUWQyV+VDCziEwb:nDksaaBGWMXNn9ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 dad7bf754114fc7f0e7908cdd68acb0bccb3eaeff77970c879dec44c3c5e5d79
- MD5 1b3c3c285c7335b0bf39f86f1ddc41df
- SHA1 bbe62f4981baa990208808c990d4d03a52e217ce
- SHA512 c87abc38a2a38d413eebe7d8c719b12d6efde6f5a0379b770142faafd5ac2f69c182ea6ed45a1946f709e1ff912c04d64312828736afe476bf3be4523bb46cfc
- SSDEEP 96:nDksaa18BwpvWMoiVmdet02Brz3nqiUWQyV+VDCAiEwb:nDkhaaBGWM902Nn9rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 53fd8be97323a7a61a8de3e79006f65e8548cbc8ce1b51019e34ed52ead9205f
- MD5 6ed06589ed254a6fa10a7569dd064d8a
- SHA1 db6395656b73351cc3b4365fb68ac0faf366d3be
- SHA512 0523889302ea23a86a124977580d6a5ec50c389672bc01ff8d5f05e2360c7019e6cb0bf96a8d381535d932982486895b30253f48fc377be6a0827aac8a5b0d48
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup8Hfe2RUl6Mj2U3z2OMDCRr:A9iIxuERzA83h09RZxY8HnwyUaOMWRHL
- MD5 SHA1 SHA512 SSDEEP