Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 15:18
Static task
static1
Behavioral task
behavioral1
Sample
a120a514ef02fe4862af344e3f4955a1_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a120a514ef02fe4862af344e3f4955a1_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a120a514ef02fe4862af344e3f4955a1_JaffaCakes118.html
- Size 124KB
- Sample240612-sp2l7atdnn
- SHA256 52f879de9f32c99f961e056cf9e45e66d68450fad9c5617867c2bd1b78617db8
- MD5 a120a514ef02fe4862af344e3f4955a1
- SHA1 a031d3ae60e9366fd9ab3d77c546ec8764c02342
- SHA512 1ec1639f04bd1b6490f3f9f0c9917b976deea0031839329ec5ae8d37a3469b14703592b4026c16ba22a6dc6cb130ac3e248b6fe95e164d93a5c3b5bbcf39cab1
- SSDEEP 3072:X8JLMiC21ILCayfkMY+BES09JXAnyrZalI+YQ:gCwsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2620 msedge.exe 2620 msedge.exe 2676 msedge.exe 2676 msedge.exe 5060 msedge.exe 5060 msedge.exe 5060 msedge.exe 5060 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2676 msedge.exe 2676 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2676 wrote to memory of 4428 2676 msedge.exe 83 PID 2676 wrote to memory of 4428 2676 msedge.exe 83 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 4860 2676 msedge.exe 85 PID 2676 wrote to memory of 2620 2676 msedge.exe 86 PID 2676 wrote to memory of 2620 2676 msedge.exe 86 PID 2676 wrote to memory of 4852 2676 msedge.exe 87 PID 2676 wrote to memory of 4852 2676 msedge.exe 87 PID 2676 wrote to memory of 4852 2676 msedge.exe 87 PID 2676 wrote to memory of 4852 2676 msedge.exe 87 PID 2676 wrote to memory of 4852 2676 msedge.exe 87 PID 2676 wrote to memory of 4852 2676 msedge.exe 87 PID 2676 wrote to memory of 4852 2676 msedge.exe 87 PID 2676 wrote to memory of 4852 2676 msedge.exe 87 PID 2676 wrote to memory of 4852 2676 msedge.exe 87 PID 2676 wrote to memory of 4852 2676 msedge.exe 87 PID 2676 wrote to memory of 4852 2676 msedge.exe 87 PID 2676 wrote to memory of 4852 2676 msedge.exe 87 PID 2676 wrote to memory of 4852 2676 msedge.exe 87 PID 2676 wrote to memory of 4852 2676 msedge.exe 87 PID 2676 wrote to memory of 4852 2676 msedge.exe 87 PID 2676 wrote to memory of 4852 2676 msedge.exe 87 PID 2676 wrote to memory of 4852 2676 msedge.exe 87 PID 2676 wrote to memory of 4852 2676 msedge.exe 87 PID 2676 wrote to memory of 4852 2676 msedge.exe 87 PID 2676 wrote to memory of 4852 2676 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a120a514ef02fe4862af344e3f4955a1_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff94a3546f8,0x7ff94a354708,0x7ff94a3547182⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4824838335784713168,18103286014032036013,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,4824838335784713168,18103286014032036013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,4824838335784713168,18103286014032036013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4824838335784713168,18103286014032036013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:3520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4824838335784713168,18103286014032036013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4824838335784713168,18103286014032036013,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5060
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:752
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2232
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
- MD5 dabfafd78687947a9de64dd5b776d25f
- SHA1 16084c74980dbad713f9d332091985808b436dea
- SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
- MD5 c39b3aa574c0c938c80eb263bb450311
- SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
- SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 9e55ec9a78e1cfbfcd67a342aea6d3b03cd2ab6ee3e61cee4d03ab931c3bd2b2
- MD5 be61285991b074e5cd0feea9057154d4
- SHA1 381b7fa3b4db3cf0587a4d8101936ae5b6811670
- SHA512 1f349b94eb3820ce579452b824fa454f53013a297f1044ffa6ea892a8bb5e9e4bfe86df38454809d0e10972d8c4c973d3843b35d1164b7a20c4f438e84683790
- SSDEEP 96:nfkBRy16pSmwpvWMoiVmdeH1DkUWQyV+VDCziEwb:nfkK6SmGWMXuro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 c3c1e2d5f9c4892ccce33fdd2b5f4fbbe44afa8dd29e9da3be900ee50b31181d
- MD5 5dd9f886b604d9d36f5ec1be74135fa5
- SHA1 e22181c5635647e06f3f23b4c50c67324d7106a4
- SHA512 b2f0db4c343665649ea9bebadec117ce791dc9fcb714e152a7de8bec032b7e662f5edbdf7711bd4aaefac3feef5905d0370e18041e4d1ddd1a208ec4e24c79db
- SSDEEP 96:nfkBty16pjmwpvWMoiVmdeQlpfq1DkUWQyV+VDCAiEwb:nfkW6jmGWM69qurV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 9d4945962afa97767801d52c4038733f466d750c6f47f3522ae65487ca1b2850
- MD5 9383c8a4b92690e2e8e7a9d8180aeaee
- SHA1 0a9f5bd23fa23102d2066f8bcdcf27c4e0c1281c
- SHA512 4cf61a0e7eb8b73c93cd7623dd1933b49f2d3b17096611bf9a77e2ad8d5d4f08a4f8400d452203c39ac2957cebbf4ce60938131df8b6530da0f5d5c27ccb3d14
- SSDEEP 96:nfkBty16pSmwpvWMoiVmdeQlq1DkUWQyV+VDCAiEwb:nfkW6SmGWM6qurV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 b97aca4ef1894e6a865601f71921b500d4e912a1192b64f0ca8a7782e21e378f
- MD5 33ec81cd3bac4431ab972b1f4bccb31f
- SHA1 df440f477b5719689434bccbb3685fee1e76e1ea
- SHA512 92422976d4362702e55b5a301d660ee5b1d3d98fc7557183042e3f52d02d9d94689c66dc914aa5c6fb05fddd889820669d5de62f9369315c8fe06e49c275c01f
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupQhe2RUy/SRsG3z2OMDCRHq:A9iIxuERzA83h09RZxY6HaGGaOMWRHq5
- MD5 SHA1 SHA512 SSDEEP