Analysis
- max time kernel
145s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 00:33
Static task
static1
Behavioral task
behavioral1
Sample
a329eeb580d1ba451cd2813556c3200c_JaffaCakes118.html
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a329eeb580d1ba451cd2813556c3200c_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a329eeb580d1ba451cd2813556c3200c_JaffaCakes118.html
- Size 64KB
- Sample240613-av7fhsxckf
- SHA256 debdbf2f91573aaa86b1abe1c8aed4b31b0378f3234a850b2fbeaca12e943744
- MD5 a329eeb580d1ba451cd2813556c3200c
- SHA1 c8ec5f0d0d77022602aab2536dd8aa2cd3a6e67e
- SHA512 888ff45789bfe5fc77bb41b2d7be73cff007efce0f1a6a78170ca5df475d2718644352f60657737afd58c9814135702004fddce2299f76ad6638c2a257a5afe3
- SSDEEP 1536:ICduDfm2XrU4x5nPvpC6Cnn68bYb3o2cvJPX6f8CH1din11CEZ/MlGY8FJbHwcv0:ICduDfpo4x5nPvpC6Cnn68bYb3o2cvJ8
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2488 msedge.exe 2488 msedge.exe 4164 msedge.exe 4164 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4164 msedge.exe 4164 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4164 wrote to memory of 3432 4164 msedge.exe 82 PID 4164 wrote to memory of 3432 4164 msedge.exe 82 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 668 4164 msedge.exe 83 PID 4164 wrote to memory of 2488 4164 msedge.exe 84 PID 4164 wrote to memory of 2488 4164 msedge.exe 84 PID 4164 wrote to memory of 1788 4164 msedge.exe 85 PID 4164 wrote to memory of 1788 4164 msedge.exe 85 PID 4164 wrote to memory of 1788 4164 msedge.exe 85 PID 4164 wrote to memory of 1788 4164 msedge.exe 85 PID 4164 wrote to memory of 1788 4164 msedge.exe 85 PID 4164 wrote to memory of 1788 4164 msedge.exe 85 PID 4164 wrote to memory of 1788 4164 msedge.exe 85 PID 4164 wrote to memory of 1788 4164 msedge.exe 85 PID 4164 wrote to memory of 1788 4164 msedge.exe 85 PID 4164 wrote to memory of 1788 4164 msedge.exe 85 PID 4164 wrote to memory of 1788 4164 msedge.exe 85 PID 4164 wrote to memory of 1788 4164 msedge.exe 85 PID 4164 wrote to memory of 1788 4164 msedge.exe 85 PID 4164 wrote to memory of 1788 4164 msedge.exe 85 PID 4164 wrote to memory of 1788 4164 msedge.exe 85 PID 4164 wrote to memory of 1788 4164 msedge.exe 85 PID 4164 wrote to memory of 1788 4164 msedge.exe 85 PID 4164 wrote to memory of 1788 4164 msedge.exe 85 PID 4164 wrote to memory of 1788 4164 msedge.exe 85 PID 4164 wrote to memory of 1788 4164 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a329eeb580d1ba451cd2813556c3200c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff825a646f8,0x7ff825a64708,0x7ff825a647182⤵PID:3432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,10503240443048833509,12949983437446140869,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:22⤵PID:668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,10503240443048833509,12949983437446140869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,10503240443048833509,12949983437446140869,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵PID:1788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,10503240443048833509,12949983437446140869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:12⤵PID:2084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,10503240443048833509,12949983437446140869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,10503240443048833509,12949983437446140869,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4620 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3240
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2184
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
- MD5 a8e767fd33edd97d306efb6905f93252
- SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
- SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
- MD5 439b5e04ca18c7fb02cf406e6eb24167
- SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
- SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 5c94f8bcc0be007b8d990fdcfcd237f99dc73733abe4338a188200b77ecc5923
- MD5 d1ac261cf6c1f768e735a1bd94b8b362
- SHA1 3c55c1ba2405e4b93c6cf81686bb868c89ee5def
- SHA512 dbaea0e45d5391287f1e3206eae4978ef9c68618e30f7a80ff519923ef3235653608b2558ab6b202252b616e0fa18152dbee8764d56efa428d259df67361e153
- SSDEEP 96:nTkGw1Be1wpvWMoiVmdeHBrzx+UWQyV+VDCziEwb:nTkD61GWMXb+ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 4bd1b915b36ea6d307b18ccbb4ac79781b45ed2a42c9b0d7a668dff1da0263d4
- MD5 64a0dfa2ff01cd6dae6bc78be723636b
- SHA1 80d031198c52890d4c7761aba0f26e89a262885a
- SHA512 876162dcafb9a7982dfdc2ff38bf8d9f6b6c325ea28fab35e9cec2e21d62df4ed09700cf2d86758b446ec9f89c664a1302089ee9923139a0b677e238c792b2b3
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfHAe2RUMMj2i:A9iIxuERzA83h09RZxYfHeWyi
- MD5 SHA1 SHA512 SSDEEP