Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 04:24
Static task
static1
Behavioral task
behavioral1
Sample
a3cfc3fceb04ba7a396304281c9033d0_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a3cfc3fceb04ba7a396304281c9033d0_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a3cfc3fceb04ba7a396304281c9033d0_JaffaCakes118.html
- Size 214KB
- Sample240613-e1f8qstgnc
- SHA256 af4194fee8c24ef67baab07decfbd3ed6221d250e5b3aef11c24afedada170c0
- MD5 a3cfc3fceb04ba7a396304281c9033d0
- SHA1 425461e2ea7d4a0bf3818a40137342a943d5ee33
- SHA512 77f3788c0e1ba29db8a1132c11e26a1e42a032770ce3f2982c9d450892b0567dcf9b4ac0c6e115e70767b89d634f781ba15cf798355b0fb944bbcdc9df9ee6f5
- SSDEEP 3072:LrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJR:/z9VxLY7iAVLTBQJlR
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3972 msedge.exe 3972 msedge.exe 2172 msedge.exe 2172 msedge.exe 1700 msedge.exe 1700 msedge.exe 1700 msedge.exe 1700 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2172 msedge.exe 2172 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe 2172 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2704 2172 msedge.exe 82 PID 2172 wrote to memory of 2704 2172 msedge.exe 82 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 2064 2172 msedge.exe 83 PID 2172 wrote to memory of 3972 2172 msedge.exe 84 PID 2172 wrote to memory of 3972 2172 msedge.exe 84 PID 2172 wrote to memory of 5064 2172 msedge.exe 85 PID 2172 wrote to memory of 5064 2172 msedge.exe 85 PID 2172 wrote to memory of 5064 2172 msedge.exe 85 PID 2172 wrote to memory of 5064 2172 msedge.exe 85 PID 2172 wrote to memory of 5064 2172 msedge.exe 85 PID 2172 wrote to memory of 5064 2172 msedge.exe 85 PID 2172 wrote to memory of 5064 2172 msedge.exe 85 PID 2172 wrote to memory of 5064 2172 msedge.exe 85 PID 2172 wrote to memory of 5064 2172 msedge.exe 85 PID 2172 wrote to memory of 5064 2172 msedge.exe 85 PID 2172 wrote to memory of 5064 2172 msedge.exe 85 PID 2172 wrote to memory of 5064 2172 msedge.exe 85 PID 2172 wrote to memory of 5064 2172 msedge.exe 85 PID 2172 wrote to memory of 5064 2172 msedge.exe 85 PID 2172 wrote to memory of 5064 2172 msedge.exe 85 PID 2172 wrote to memory of 5064 2172 msedge.exe 85 PID 2172 wrote to memory of 5064 2172 msedge.exe 85 PID 2172 wrote to memory of 5064 2172 msedge.exe 85 PID 2172 wrote to memory of 5064 2172 msedge.exe 85 PID 2172 wrote to memory of 5064 2172 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3cfc3fceb04ba7a396304281c9033d0_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcac9d46f8,0x7ffcac9d4708,0x7ffcac9d47182⤵PID:2704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,4165023271923064011,12752374921907781257,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:22⤵PID:2064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,4165023271923064011,12752374921907781257,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,4165023271923064011,12752374921907781257,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:82⤵PID:5064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,4165023271923064011,12752374921907781257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,4165023271923064011,12752374921907781257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:3308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,4165023271923064011,12752374921907781257,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4936 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1700
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3908
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4792
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
- MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
- SHA1 86174e670c44767c08a39cc2a53c09c318326201
- SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
- MD5 b704c9ca0493bd4548ac9c69dc4a4f27
- SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
- SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2b7c4cd2-9692-4444-bbbe-f582611aa0f7.tmp
- Size 6KB
- SHA256 75e3c189101b4ee5b65dbee048cced7a493b23926fca7f06e8149d4b3c8e5bd6
- MD5 69c5dbf051f23af815c038dbb7ba9fe9
- SHA1 b1e319f5f01a1539f96aec8cc037eec9c6b47d3a
- SHA512 8a229404a2c8ba6ecd71a2224c05e6ab3b6a1bc553725ee06ab08cba14da98982d4d5e0827d8a9f2394ca1a860e0799ff78aff948ed1fc49f4333a7744f534a7
- SSDEEP 96:nJk/oxm/DQYmq91kHvwpvWMoiVmdeH2Wfte+UWQyV+VDCziEwb:nJkBIiiHvGWMXo+ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 2a618ae11cb75ce5a4c4c3843446d4d2c8b4fef265f6fb3ddc2a7bfaf7f2f35c
- MD5 84de85c6254da1a8b38997f4baddda81
- SHA1 c3a2d29c7db48cf27e7becc935e9fa7adf247c6a
- SHA512 1114b205b8db577a3e4535cc4f7327b505eb8291d0a842f5bb6b0f9686d39f9c76f507809ebc939c3f1228b80092b430c5d077c8b7d97c2c7667871c6da63e24
- SSDEEP 96:nJk/oxm/Dnmq91kHvwpvWMoiVmdeuHq2Wfte+UWQyV+VDCAiEwb:nJkB6iiHvGWMeHqo+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 dc9e6ffa9aedf7f8979826a8ac2b7b57229a9b02e22555e135bd6efdea7de621
- MD5 2c769592ec04a813575392c9f9b004fa
- SHA1 5933cb7394593e22941624a3651e505444fa11b7
- SHA512 ffdb8bc158530023a841aa7a018f9c112ee7d7e60866f0ebd5bc63a5ba112158712c833b1859f59c961114431306c23a658aa3cf5697a842d2aaf28c0e760c3f
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup0HfPe2RUUh/A3z2OMDCRHB:A9iIxuERzA83h09RZxY+vXAaOMWRHql0
- MD5 SHA1 SHA512 SSDEEP