Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 00:24
Static task
static1
Behavioral task
behavioral1
Sample
a320cc4b3d02fd6d7d624d15947e2428_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a320cc4b3d02fd6d7d624d15947e2428_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a320cc4b3d02fd6d7d624d15947e2428_JaffaCakes118.html
- Size 157KB
- Sample240613-ap12jsxala
- SHA256 a5ebae998a29a627fb9566e43b3e4c5b272af1b5ab4f962e5226f54b628ddc4e
- MD5 a320cc4b3d02fd6d7d624d15947e2428
- SHA1 582efe18c4fceefd9ba51da68bd98e7b642594ed
- SHA512 3cd5ced2af737b967ef50085b24c7de145953802fa3625c7615b38d2e10b57e7897edbbcd1951e8ad1d2eb5c4e410b66280af6c09ed49513b49fdc8d92d73620
- SSDEEP 1536:SwNFQqv0A3UHr3SwreOqeBpMRaasmy9JY/2NEsKE31owGiWzNYGmYqOZuclIwJPu:SwOCLFjZyfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4240 msedge.exe 4240 msedge.exe 980 msedge.exe 980 msedge.exe 2576 msedge.exe 2576 msedge.exe 2576 msedge.exe 2576 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 980 msedge.exe 980 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe 980 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 980 wrote to memory of 2392 980 msedge.exe 82 PID 980 wrote to memory of 2392 980 msedge.exe 82 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 1804 980 msedge.exe 83 PID 980 wrote to memory of 4240 980 msedge.exe 84 PID 980 wrote to memory of 4240 980 msedge.exe 84 PID 980 wrote to memory of 1352 980 msedge.exe 85 PID 980 wrote to memory of 1352 980 msedge.exe 85 PID 980 wrote to memory of 1352 980 msedge.exe 85 PID 980 wrote to memory of 1352 980 msedge.exe 85 PID 980 wrote to memory of 1352 980 msedge.exe 85 PID 980 wrote to memory of 1352 980 msedge.exe 85 PID 980 wrote to memory of 1352 980 msedge.exe 85 PID 980 wrote to memory of 1352 980 msedge.exe 85 PID 980 wrote to memory of 1352 980 msedge.exe 85 PID 980 wrote to memory of 1352 980 msedge.exe 85 PID 980 wrote to memory of 1352 980 msedge.exe 85 PID 980 wrote to memory of 1352 980 msedge.exe 85 PID 980 wrote to memory of 1352 980 msedge.exe 85 PID 980 wrote to memory of 1352 980 msedge.exe 85 PID 980 wrote to memory of 1352 980 msedge.exe 85 PID 980 wrote to memory of 1352 980 msedge.exe 85 PID 980 wrote to memory of 1352 980 msedge.exe 85 PID 980 wrote to memory of 1352 980 msedge.exe 85 PID 980 wrote to memory of 1352 980 msedge.exe 85 PID 980 wrote to memory of 1352 980 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a320cc4b3d02fd6d7d624d15947e2428_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbdf746f8,0x7fffbdf74708,0x7fffbdf747182⤵PID:2392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,5147618596359412694,10110410935732843944,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:22⤵PID:1804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,5147618596359412694,10110410935732843944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,5147618596359412694,10110410935732843944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:82⤵PID:1352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5147618596359412694,10110410935732843944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5147618596359412694,10110410935732843944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:4736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,5147618596359412694,10110410935732843944,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4888 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2576
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2920
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
- MD5 dabfafd78687947a9de64dd5b776d25f
- SHA1 16084c74980dbad713f9d332091985808b436dea
- SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
- MD5 c39b3aa574c0c938c80eb263bb450311
- SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
- SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 82a8ea2d01d96de630d1d318d06bcb5920f442b4cd4ac0b44ae53ac0bc4aefdc
- MD5 e22530d60afb6153048098ff4d0ef3ff
- SHA1 a27c3901d359c0d4008dcad06c2bab4f700aa79f
- SHA512 fdeb275977ad6d3c5efa2b7634cc42193ed8430deb5fdae4109def9147f1c4211f724940a64f776ffce7e234b999b3dac042aec42a9e6a96cd2d40946b2f3a58
- SSDEEP 96:n4kVoxm/DQYmqP150GmwpvWMoiVmdeH1DmLUWQyV+VDCziEwb:n4kfIUYGmGWMXcLro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 e919256c1fd03276874273f601b442a4e822f3e7b37c3df854e84ae237a35b4b
- MD5 29e0353d2d490320521483250d92838c
- SHA1 62e8d871f1d5ab19b067025efc2a5f0a8e81fb9d
- SHA512 e07b2d6f5f7f5b5b147572275cacb18f596bc4922a9b3528e1834d579dcbf6ddfabf10b91297061d0458975c5cef735bea83a9df7ccd7e2d68312bc1cf212446
- SSDEEP 96:n4kVoxm/DnmqP150nmwpvWMoiVmdeH1DmLUWQyV+VDCAiEwb:n4kf6UYnmGWMXcLrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 167363cd9383e069af5098b872c5fd005bf3c08ca63c72ef634abe2dc562cf86
- MD5 f6fedad08845d46e7250f37441b7312b
- SHA1 bd2f801adcfe0d566b3570c6140075c6123ee005
- SHA512 770599a1f74d07a3633b87dc37cdb1931c295d322c1cc6acd1811e17e632ce0d6201fb2de7d915b4a694b3d699f562d6b0b91554525be0794dbef3112adb8c8b
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDSe2RUL/SRsV3z2OMDCRHM:A9iIxuERzA83h09RZxYo+aGVaOMWRHqv
- MD5 SHA1 SHA512 SSDEEP