Analysis
- max time kernel
120s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 03:44
Static task
static1
Behavioral task
behavioral1
Sample
a3b77cdb0f2f5de6768d99d48e0f4e26_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a3b77cdb0f2f5de6768d99d48e0f4e26_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a3b77cdb0f2f5de6768d99d48e0f4e26_JaffaCakes118.html
- Size 3KB
- Sample240613-eaqpgswhmr
- SHA256 facc4c4eff673c0381431b335954d13604a7ec89b685272af4ec64370fca975e
- MD5 a3b77cdb0f2f5de6768d99d48e0f4e26
- SHA1 3ef776447e864fefd9b98069dad99c6ff5232922
- SHA512 35780152c69081921a96430c90d8bc6d95854cee5a453e3e915ee9feb92f5dcde521a26f726b36cef50804dfb4a92e98bf06f26fa90009c59c7294c7e4421944
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4276 msedge.exe 4276 msedge.exe 3912 msedge.exe 3912 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3912 msedge.exe 3912 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe 3912 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3912 wrote to memory of 3684 3912 msedge.exe 81 PID 3912 wrote to memory of 3684 3912 msedge.exe 81 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 376 3912 msedge.exe 82 PID 3912 wrote to memory of 4276 3912 msedge.exe 83 PID 3912 wrote to memory of 4276 3912 msedge.exe 83 PID 3912 wrote to memory of 3328 3912 msedge.exe 84 PID 3912 wrote to memory of 3328 3912 msedge.exe 84 PID 3912 wrote to memory of 3328 3912 msedge.exe 84 PID 3912 wrote to memory of 3328 3912 msedge.exe 84 PID 3912 wrote to memory of 3328 3912 msedge.exe 84 PID 3912 wrote to memory of 3328 3912 msedge.exe 84 PID 3912 wrote to memory of 3328 3912 msedge.exe 84 PID 3912 wrote to memory of 3328 3912 msedge.exe 84 PID 3912 wrote to memory of 3328 3912 msedge.exe 84 PID 3912 wrote to memory of 3328 3912 msedge.exe 84 PID 3912 wrote to memory of 3328 3912 msedge.exe 84 PID 3912 wrote to memory of 3328 3912 msedge.exe 84 PID 3912 wrote to memory of 3328 3912 msedge.exe 84 PID 3912 wrote to memory of 3328 3912 msedge.exe 84 PID 3912 wrote to memory of 3328 3912 msedge.exe 84 PID 3912 wrote to memory of 3328 3912 msedge.exe 84 PID 3912 wrote to memory of 3328 3912 msedge.exe 84 PID 3912 wrote to memory of 3328 3912 msedge.exe 84 PID 3912 wrote to memory of 3328 3912 msedge.exe 84 PID 3912 wrote to memory of 3328 3912 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3b77cdb0f2f5de6768d99d48e0f4e26_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e53746f8,0x7ff9e5374708,0x7ff9e53747182⤵PID:3684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13964936355459438353,12916082404647450193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵PID:376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,13964936355459438353,12916082404647450193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,13964936355459438353,12916082404647450193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:82⤵PID:3328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13964936355459438353,12916082404647450193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:2484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13964936355459438353,12916082404647450193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:4416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13964936355459438353,12916082404647450193,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4552 /prefetch:22⤵PID:5092
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3452
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3256
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
- MD5 ce4c898f8fc7601e2fbc252fdadb5115
- SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
- SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
- MD5 4158365912175436289496136e7912c2
- SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
- SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 c36ae7d8f0595374d79532e7b493df8c96603bb1fd3aa0d8ee03db774d765a5d
- MD5 6aae3b658ac56f9be9492a41b6491bdc
- SHA1 2a44880d981d2e0ec3b3e55360365d119772cd44
- SHA512 96e11cb7e304a2dd314dbbde0e7348debc7216d487ed1e69a58a736c70c02acb330b21b12bf8d8d5fbcb3c405e675ad08b8f8919da357e686ab34e332873090d
- SSDEEP 96:ngrk0O16QjuwpvWMoiVmdeHvSSZEUWQyV+VDCziEwb:nUkvAQjuGWMXrEro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 d08818110ca970a1813c6c133892565e1afd604e0e2498059b286be9f3e9a6ff
- MD5 d1a409cba47c56492c8104cdefc69444
- SHA1 0d4f181e14c6dcf55fb34cb0b8ee992d167fca85
- SHA512 1afe897598c208b3b27387652e8fdfc44b481daf7d2f615ebadac264312655ea3af6773fed04cb9a2cd6a384ec006d63143e212731001a3dd7ff9b9700129e63
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupiNe2RU1mRuy:A9iIxuERzA83h09RZxYiJmy
- MD5 SHA1 SHA512 SSDEEP