Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 00:48
Static task
static1
Behavioral task
behavioral1
Sample
a339c20a90fc9a907b798ec29471cc01_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a339c20a90fc9a907b798ec29471cc01_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a339c20a90fc9a907b798ec29471cc01_JaffaCakes118.html
- Size 140KB
- Sample240613-a54sda1fqq
- SHA256 36f06df6337921ec726ae8dae2bd2c3a0fa6003e42ceeb1fd76c19289cf9e54f
- MD5 a339c20a90fc9a907b798ec29471cc01
- SHA1 a09382604afcaebe0a946bd95a504c913777f54b
- SHA512 f90bdd67a37435b941d3a98380990f004222857af82f874bb4b502cf7af2db3f92cb5928986378f5fe1c50e8eddd89ba39ffe8fd60a365728b129fdb14cce08f
- SSDEEP 1536:SgVZM/dunlngyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:SgV6yfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 448 msedge.exe 448 msedge.exe 3164 msedge.exe 3164 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3164 msedge.exe 3164 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3164 wrote to memory of 1000 3164 msedge.exe 80 PID 3164 wrote to memory of 1000 3164 msedge.exe 80 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 732 3164 msedge.exe 81 PID 3164 wrote to memory of 448 3164 msedge.exe 82 PID 3164 wrote to memory of 448 3164 msedge.exe 82 PID 3164 wrote to memory of 828 3164 msedge.exe 83 PID 3164 wrote to memory of 828 3164 msedge.exe 83 PID 3164 wrote to memory of 828 3164 msedge.exe 83 PID 3164 wrote to memory of 828 3164 msedge.exe 83 PID 3164 wrote to memory of 828 3164 msedge.exe 83 PID 3164 wrote to memory of 828 3164 msedge.exe 83 PID 3164 wrote to memory of 828 3164 msedge.exe 83 PID 3164 wrote to memory of 828 3164 msedge.exe 83 PID 3164 wrote to memory of 828 3164 msedge.exe 83 PID 3164 wrote to memory of 828 3164 msedge.exe 83 PID 3164 wrote to memory of 828 3164 msedge.exe 83 PID 3164 wrote to memory of 828 3164 msedge.exe 83 PID 3164 wrote to memory of 828 3164 msedge.exe 83 PID 3164 wrote to memory of 828 3164 msedge.exe 83 PID 3164 wrote to memory of 828 3164 msedge.exe 83 PID 3164 wrote to memory of 828 3164 msedge.exe 83 PID 3164 wrote to memory of 828 3164 msedge.exe 83 PID 3164 wrote to memory of 828 3164 msedge.exe 83 PID 3164 wrote to memory of 828 3164 msedge.exe 83 PID 3164 wrote to memory of 828 3164 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a339c20a90fc9a907b798ec29471cc01_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe197b46f8,0x7ffe197b4708,0x7ffe197b47182⤵PID:1000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,4965377131905100200,1259137071998897651,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,4965377131905100200,1259137071998897651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,4965377131905100200,1259137071998897651,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4965377131905100200,1259137071998897651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:3524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4965377131905100200,1259137071998897651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:2148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,4965377131905100200,1259137071998897651,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3980
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3520
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
- MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
- SHA1 86174e670c44767c08a39cc2a53c09c318326201
- SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
- MD5 b704c9ca0493bd4548ac9c69dc4a4f27
- SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
- SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7185c245-9233-433b-a9e5-2f5a5e61db9b.tmp
- Size 6KB
- SHA256 460512c3896ed1d38f9249c33999915312bb96aba26f610b7c1269002401955f
- MD5 89bd3762ebe1d702d8e8093d50de479d
- SHA1 d356565b8c719a724267a69d3e17e9b16288d97b
- SHA512 2b12242b98051874d739a073ac824b036e3fb98e615011a78a1ec49d9422873f0bce81753b0995cd196abef88c1f2b6a12232998f148d3b18f798343922ffc17
- SSDEEP 96:nx6k/oxm/DnmqBg1UKwpvWMoiVmdeH2Wf3B+UWQyV+VDCAiEwb:nQkB6xKKGWMXHB+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 5b1a268216c1bf61a70afc14bf691058260790cde84d645dfadb7fed2c21cf52
- MD5 10c0033e4a4c670331aa6aa4afd82ed3
- SHA1 cf8a47d2a3ff517bbf40e5ea7206c0867a5e2b49
- SHA512 bc77106f616afc053f73589a3ce7a81bd1d057f9ae5e3e16e70f42d7cb08ce2ef77ada4e15fa73b91f7df4b0b8d413ee44c9b032986edb426a295c39ca513bfb
- SSDEEP 96:nx6k/oxm/DQYmqBg1UvwpvWMoiVmdeH2Wf3B+UWQyV+VDCziEwb:nQkBIxKvGWMXHB+ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 283e84f860556e0f68fee41855a52049cc4c73ad44cd73068ca70c8d63cf107d
- MD5 48d505db540b1f316ef072b8071a3dc7
- SHA1 22d504790850494efb3aef43d84b81c0f683fa70
- SHA512 e3f4682931102fad34b4f30d7fa80659322aff1d5ec1f077ac75b316e2a1dc86d0b7c8f098066c5a10fc07445fe428a840770dfeeaab8d74eb361c2bc5c71b57
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupPHf5de2RUkh/W3z2OMDCRx:A9iIxuERzA83h09RZxYfx5PWaOMWRHqa
- MD5 SHA1 SHA512 SSDEEP