Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 02:01
Static task
static1
Behavioral task
behavioral1
Sample
a37946bfc234ab15d0808d82542667ae_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a37946bfc234ab15d0808d82542667ae_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a37946bfc234ab15d0808d82542667ae_JaffaCakes118.html
- Size 318KB
- Sample240613-cf2ylatgnm
- SHA256 99ff38b0864b8a5c78562635c42a393877938dac7058a2be72d350d4a2a28414
- MD5 a37946bfc234ab15d0808d82542667ae
- SHA1 43efb1d1b5aba3d97fa0d3f1a0c4636fbd182e25
- SHA512 4ac96a82669d4e24fcd2725e45202bacd3f3ac94d9011e607b59060b0813f63b14e37c0f710763dfee316efc2322d991b447bf5c2a78cad5c99ae1599150504e
- SSDEEP 3072:V5XTkKeT+F1inedjK5hhrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJ/:nIKeSF1inedjKv1z9VxLY7iAVLTBQJl/
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4392 msedge.exe 4392 msedge.exe 4212 msedge.exe 4212 msedge.exe 364 msedge.exe 364 msedge.exe 364 msedge.exe 364 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4212 msedge.exe 4212 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4212 wrote to memory of 5028 4212 msedge.exe 81 PID 4212 wrote to memory of 5028 4212 msedge.exe 81 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 2236 4212 msedge.exe 82 PID 4212 wrote to memory of 4392 4212 msedge.exe 83 PID 4212 wrote to memory of 4392 4212 msedge.exe 83 PID 4212 wrote to memory of 2576 4212 msedge.exe 84 PID 4212 wrote to memory of 2576 4212 msedge.exe 84 PID 4212 wrote to memory of 2576 4212 msedge.exe 84 PID 4212 wrote to memory of 2576 4212 msedge.exe 84 PID 4212 wrote to memory of 2576 4212 msedge.exe 84 PID 4212 wrote to memory of 2576 4212 msedge.exe 84 PID 4212 wrote to memory of 2576 4212 msedge.exe 84 PID 4212 wrote to memory of 2576 4212 msedge.exe 84 PID 4212 wrote to memory of 2576 4212 msedge.exe 84 PID 4212 wrote to memory of 2576 4212 msedge.exe 84 PID 4212 wrote to memory of 2576 4212 msedge.exe 84 PID 4212 wrote to memory of 2576 4212 msedge.exe 84 PID 4212 wrote to memory of 2576 4212 msedge.exe 84 PID 4212 wrote to memory of 2576 4212 msedge.exe 84 PID 4212 wrote to memory of 2576 4212 msedge.exe 84 PID 4212 wrote to memory of 2576 4212 msedge.exe 84 PID 4212 wrote to memory of 2576 4212 msedge.exe 84 PID 4212 wrote to memory of 2576 4212 msedge.exe 84 PID 4212 wrote to memory of 2576 4212 msedge.exe 84 PID 4212 wrote to memory of 2576 4212 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a37946bfc234ab15d0808d82542667ae_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe473b46f8,0x7ffe473b4708,0x7ffe473b47182⤵PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10657980590589261525,17952355737105672193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:2236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,10657980590589261525,17952355737105672193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,10657980590589261525,17952355737105672193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:82⤵PID:2576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10657980590589261525,17952355737105672193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:3160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10657980590589261525,17952355737105672193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:4112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10657980590589261525,17952355737105672193,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:364
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3448
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4224
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
- MD5 dabfafd78687947a9de64dd5b776d25f
- SHA1 16084c74980dbad713f9d332091985808b436dea
- SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
- MD5 c39b3aa574c0c938c80eb263bb450311
- SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
- SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 180B
- SHA256 f19519efc60a2c7dfed33a737f59060a149116421709580ae6b8d7f576133bad
- MD5 896d5c774e5e3a936896d9a318dbf96d
- SHA1 0d4d2d9b288f5587441271b5455323e8a3dae638
- SHA512 62ec009a4f36be033257bcc4fe1c127dc171e2d56d0e6fc35d046db955de799c080b7c8ae26dfc81b0ce637d68c54ddfd641a5c5249638d0072a741b4a502fd4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 e40b43211205d15d4a7f07b250968e15b419eeb706f80fd941b06ff5a6fe24f1
- MD5 b05b6fc3f159144c2e8399f52f589b51
- SHA1 c77ef5795f122fd04060d9437f673843651595ee
- SHA512 af7901b05bf2af04cdf3bd4baac8f62f9955a3b049f6266a541bd6946c47c22dc74dafc0836ead73e00714d0f49dcd82528bba0832d0b0560aa24e4714783051
- SSDEEP 96:n0fk/oxm/Dnmqv1dzmwpvWMoiVmdeH133UWQyV+VDCAiEwb:n8kB6Y/zmGWMXBrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 c365bf51b3e42429fde17bfb3787f5f67cff09932fa5d6f8ab36ebc0aba14e91
- MD5 e383002c92960ca9b63cfbfce167db54
- SHA1 95d234b145ddb6be7d8a93c6db1150bf51f3cfb7
- SHA512 6dfcfaea21b60b9bf2ef0ddac7bf3e1d6181b2a4cb079c4822d437fab28b21e415ae7ef182289d049eff6abcd23625c338f245080ed78c364b4ddc76720f8db3
- SSDEEP 96:n0fk/oxm/Dnmqv1dCmwpvWMoiVmdeH1D3UWQyV+VDCAiEwb:n8kB6Y/CmGWMXZrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c9fbb9f8-05f7-4cb0-92a0-35812a526683.tmp
- Size 6KB
- SHA256 0e56915eab529b441a00a76ccf1636fd5a0991875122e56655a3c8879c97087a
- MD5 2b690c91a451879c9ff0600c8633a396
- SHA1 fb8a6dfbd66a17758e4cdd749b47a1d67c0dad9a
- SHA512 8a4649f321299d9cafab451d6f16f8dafb0eaa1b8f09ad43c762e212ebb01190f909346836ef87afb0f64ef65f42f91c7837ede7383449383ac1e59be7816b70
- SSDEEP 96:n0fk/oxm/DQYmqv1dCmwpvWMoiVmdeH1D3UWQyV+VDCziEwb:n8kBIY/CmGWMXZro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 af1a47425e9415f59f6fa401a8842583db552599764cdc209f26ff2a31cbe981
- MD5 552d243bc62a2a77f1cf862aeedee18f
- SHA1 888a4be4c6338c563a223a06b768a5e1c382a4ef
- SHA512 46fbf628c85df6341742925528b9234f0d6da0844484e0ca9cfc410b0b9feb4da8baf1d0b572f704ad35460a9d954961a0c636319e4aadad39bb976f952694c6
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphf6+e2RUKSRsz3z2OMDCR1:A9iIxuERzA83h09RZxYhfFCGzaOMWRHV
- MD5 SHA1 SHA512 SSDEEP