Analysis
- max time kernel
145s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 04:28
Static task
static1
Behavioral task
behavioral1
Sample
a3d171d893decaa03a657560cb3cbf57_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a3d171d893decaa03a657560cb3cbf57_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a3d171d893decaa03a657560cb3cbf57_JaffaCakes118.html
- Size 12KB
- Sample240613-e3y7bsthkb
- SHA256 b8a9cdc999c09687dbf9d2fdbab49124ca7b423d58611c4e1b6570aa1f103733
- MD5 a3d171d893decaa03a657560cb3cbf57
- SHA1 fc02f78a72182f39d584b028f5f994403c35535e
- SHA512 21ba9bfb2cc36a05b107a4e7cbad2a2c50810fdd9d21991b198bf67cc6ebc6b88ede8a01e22bfdf8a4edb4f5bfc1b1c1edc65547b6a37ffa0da08d8076bada58
- SSDEEP 384:uPIT0sV8Dp/G/u65Y/Uu8/9tG0G40gu0Z+SKuM:GIT0sV8Dp/G/P5Y/Uu8bG14V3LK5
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5032 msedge.exe 5032 msedge.exe 3296 msedge.exe 3296 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3296 msedge.exe 3296 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3296 wrote to memory of 4592 3296 msedge.exe 81 PID 3296 wrote to memory of 4592 3296 msedge.exe 81 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 4740 3296 msedge.exe 82 PID 3296 wrote to memory of 5032 3296 msedge.exe 83 PID 3296 wrote to memory of 5032 3296 msedge.exe 83 PID 3296 wrote to memory of 1032 3296 msedge.exe 84 PID 3296 wrote to memory of 1032 3296 msedge.exe 84 PID 3296 wrote to memory of 1032 3296 msedge.exe 84 PID 3296 wrote to memory of 1032 3296 msedge.exe 84 PID 3296 wrote to memory of 1032 3296 msedge.exe 84 PID 3296 wrote to memory of 1032 3296 msedge.exe 84 PID 3296 wrote to memory of 1032 3296 msedge.exe 84 PID 3296 wrote to memory of 1032 3296 msedge.exe 84 PID 3296 wrote to memory of 1032 3296 msedge.exe 84 PID 3296 wrote to memory of 1032 3296 msedge.exe 84 PID 3296 wrote to memory of 1032 3296 msedge.exe 84 PID 3296 wrote to memory of 1032 3296 msedge.exe 84 PID 3296 wrote to memory of 1032 3296 msedge.exe 84 PID 3296 wrote to memory of 1032 3296 msedge.exe 84 PID 3296 wrote to memory of 1032 3296 msedge.exe 84 PID 3296 wrote to memory of 1032 3296 msedge.exe 84 PID 3296 wrote to memory of 1032 3296 msedge.exe 84 PID 3296 wrote to memory of 1032 3296 msedge.exe 84 PID 3296 wrote to memory of 1032 3296 msedge.exe 84 PID 3296 wrote to memory of 1032 3296 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3d171d893decaa03a657560cb3cbf57_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffaab146f8,0x7fffaab14708,0x7fffaab147182⤵PID:4592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,6246526585804964680,2158265071929865785,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:22⤵PID:4740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,6246526585804964680,2158265071929865785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,6246526585804964680,2158265071929865785,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:82⤵PID:1032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6246526585804964680,2158265071929865785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6246526585804964680,2158265071929865785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:4440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,6246526585804964680,2158265071929865785,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4784 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:612
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4536
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3424
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
- MD5 dabfafd78687947a9de64dd5b776d25f
- SHA1 16084c74980dbad713f9d332091985808b436dea
- SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
- MD5 c39b3aa574c0c938c80eb263bb450311
- SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
- SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 e916b3821a0c5c1ab319a1ab7ecf19ce90d4f99e935b532d0e0fc7119c4dfc0d
- MD5 b1ec56df1d1faca73e5c791673373b82
- SHA1 70f8bb0f78cba5ce97d4d39cae81d23955037510
- SHA512 2de9784e161edecac49728715c1fd487f7e8021ecfd7c3360cf09982567101617a6d782d5c4dddf4a0032af3d05c627df9f45924de5d651cccf7e5d2784f1bd7
- SSDEEP 96:n6kBoxm/DQYmqA1SSmwpvWMoiVmdeH1DRFUWQyV+VDCziEwb:n6krIXQSmGWMXdro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 9ead9931f0c3a95916670137c1f1cfc6e267112b8c7fec6094096d012d682baf
- MD5 0dd7e97eae0dc9ca3d162fad10926a5d
- SHA1 e4af370b42a5206f5bbbb6b490556bf77595032c
- SHA512 1c9f03c33c31e5815afa80fd19a8d87246beef55aa5f56c26a4ff2f8ca128523a918bf27b4eb08b6cec5f53ec32cb5807176063b1dd7b323a14eefb39d929dab
- SSDEEP 96:n6kBoxm/DnmqA1SSmwpvWMoiVmdea21DRFUWQyV+VDCAiEwb:n6kr6XQSmGWMq2drV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 9fa65e2d40ecb6570cccd4cf3ad0ae16c19b0de5f9f4c7ff80588db5fbecd0de
- MD5 2e34e9ef6dd5e33f976d3b5520d9e731
- SHA1 265f59c0cdc8f1778f02e53a8aa0f83aee8ed3bd
- SHA512 168751e95953aaa840ee1ffd2fbeca60111780d74a39e35f4588b01b4a739568ce40b5e29241e784359f7dc2411f84a7ab5690adac77703305c5a7658c4da4e9
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupmo8e2RUISRsq3z2OMDCRH5:A9iIxuERzA83h09RZxYjigGqaOMWRHqq
- MD5 SHA1 SHA512 SSDEEP