Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 04:12
Static task
static1
Behavioral task
behavioral1
Sample
a3c9f227b56e27adc9d830c357720d39_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a3c9f227b56e27adc9d830c357720d39_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a3c9f227b56e27adc9d830c357720d39_JaffaCakes118.html
- Size 119KB
- Sample240613-esv2xstfjb
- SHA256 f9cdf4da8b444d3bf6d7785abcd542a93925f78fe8e4bd01e323181b71445228
- MD5 a3c9f227b56e27adc9d830c357720d39
- SHA1 ff7bf2cee01ef7ce5a69c21cd575d8038080de56
- SHA512 0b111df243ce95571a05163a3a55ccdf55e488033180ec6e76a96d866fa3568e97293080eda2a4bc53925f0840f4cb3d5a035f76acf509855bef6b793a6c2803
- SSDEEP 1536:tqTpGtBSdxeu0jM3+1XgepewkjL6XK2gVqASH5ZcW3mkqGpezHekepeUeHWSGVz6:ICOG3mGSOyLD7SpZ0V
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2660 msedge.exe 2660 msedge.exe 3248 msedge.exe 3248 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3248 wrote to memory of 3128 3248 msedge.exe 82 PID 3248 wrote to memory of 3128 3248 msedge.exe 82 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 3160 3248 msedge.exe 83 PID 3248 wrote to memory of 2660 3248 msedge.exe 84 PID 3248 wrote to memory of 2660 3248 msedge.exe 84 PID 3248 wrote to memory of 4248 3248 msedge.exe 85 PID 3248 wrote to memory of 4248 3248 msedge.exe 85 PID 3248 wrote to memory of 4248 3248 msedge.exe 85 PID 3248 wrote to memory of 4248 3248 msedge.exe 85 PID 3248 wrote to memory of 4248 3248 msedge.exe 85 PID 3248 wrote to memory of 4248 3248 msedge.exe 85 PID 3248 wrote to memory of 4248 3248 msedge.exe 85 PID 3248 wrote to memory of 4248 3248 msedge.exe 85 PID 3248 wrote to memory of 4248 3248 msedge.exe 85 PID 3248 wrote to memory of 4248 3248 msedge.exe 85 PID 3248 wrote to memory of 4248 3248 msedge.exe 85 PID 3248 wrote to memory of 4248 3248 msedge.exe 85 PID 3248 wrote to memory of 4248 3248 msedge.exe 85 PID 3248 wrote to memory of 4248 3248 msedge.exe 85 PID 3248 wrote to memory of 4248 3248 msedge.exe 85 PID 3248 wrote to memory of 4248 3248 msedge.exe 85 PID 3248 wrote to memory of 4248 3248 msedge.exe 85 PID 3248 wrote to memory of 4248 3248 msedge.exe 85 PID 3248 wrote to memory of 4248 3248 msedge.exe 85 PID 3248 wrote to memory of 4248 3248 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3c9f227b56e27adc9d830c357720d39_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd90b646f8,0x7ffd90b64708,0x7ffd90b647182⤵PID:3128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,7422301530701749144,5407732377075876395,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:22⤵PID:3160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,7422301530701749144,5407732377075876395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,7422301530701749144,5407732377075876395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:82⤵PID:4248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7422301530701749144,5407732377075876395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7422301530701749144,5407732377075876395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:4484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7422301530701749144,5407732377075876395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:12⤵PID:2160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,7422301530701749144,5407732377075876395,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4412
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3732
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e
- MD5 db9081c34e133c32d02f593df88f047a
- SHA1 a0da007c14fd0591091924edc44bee90456700c6
- SHA512 12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f
- MD5 3a09f853479af373691d131247040276
- SHA1 1b6f098e04da87e9cf2d3284943ec2144f36ac04
- SHA512 341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3be4855d-d1b5-46a3-a6ef-7538e1f4779a.tmp
- Size 371B
- SHA256 403f180d10a4545752255c3a61000ba201a9744434466b07168a0c1c1099e5e7
- MD5 0cd250167ec9473ac0b9595cf7baa1ea
- SHA1 31ccae7375487cf4bad36fcc968f77a7994b4802
- SHA512 25007771835569be6d1e004e195bd51e722caec27eddc16619266217ef0522852704de661a26afc399bb1d381a340b6d7fa24d20cfa87fd51428aee89fb67978
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 eba7472b61c699ed354e79d2de00e4f19667ad002627f8354f47cf700e671c7f
- MD5 2d818dd0caab1b4eb3e4b202a87ba2e5
- SHA1 15ea08c8b91d2db55acf19dcc167c771487477c8
- SHA512 c98c94d36445cc28da3f1bf1582f9fc6e67378588a10fbf6550d2aa2259326e98c1faf6bf2df41d59f37445db0e2cd1314e0bdf1a9b10e3659f6dc6b092ee053
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 262B
- SHA256 07d871bd5941e11d7cece86658574fc7fb4733e3386b3977800df9b4d23a3947
- MD5 a0323b2a17840b1a147f926b10348313
- SHA1 6436d9115328e71287236c84cfabbe04e9086099
- SHA512 896504e3220dec90bcbacd4eeeae0f9910b2e289f0104df97ad7fc323bd57d6f231e9a42c80c744fcc4ee8c0c9cf861c5a6cd9f171d7139c1f6154964bbca5f9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 715fa8e3aecb422c64fac50f8e00da43a1946aeba89c98d471f59491d319978d
- MD5 ac8d4a9b9be16dd55771922026ab34b5
- SHA1 02e292668d21eab52e47f7f41a5d09f060b99313
- SHA512 103e1650f5b194b642cd9431d699f6f73f73a6c5b0bcf36ab09976d26e9ce5e24af69d4c1dc1082e666228482d2c3c25bf73727b6b9af071e0bb590b30df1687
- SSDEEP 96:nXk/oxm/Dnmqo10tK/wpvWMoiVmdeBRxE6P2gibnUWQyV+VDCAiEwb:nXkB67YEGWMxRxE6P2bnrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 aae01b2d34b041a3b05e4f43eff41a4f1bc710dd4639c70fbaf81ec6b67d3f3e
- MD5 0b961e4dea935b640feca2b5b1fde154
- SHA1 440fe5ad1c550000c4e2347fc9bd560ee0f5e658
- SHA512 48314e170dbf19ca2befb9e2a37f9e7fb715203685d95afdb9ed5b382c5804937a07bb3b50f9b25a511dea9b746f986305b9a785f56d0bebdfd7418bed509a51
- SSDEEP 96:nXk/oxm/DQYmqo10tK/wpvWMoiVmdeHgibnUWQyV+VDCziEwb:nXkBI7YEGWMXbnro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583217.TMP
- Size 371B
- SHA256 f616c90ba2b77f025b01e4cc7af5fa6b2bc11cc0cabc0799b9e08998a36777be
- MD5 9354d33c4f15f076edf253c2b31ea3f7
- SHA1 3efcd23353b65c97f78217bd7c4c5c942237c333
- SHA512 75c61ff47f1917e330144a2e89a5c30ebbb73d63099b99828175e1263d05e1f7569d10c6af74e55ce1319f961983ff72895d6f44be394b90f2c551076d9ddad2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 ef124ba7462fceb42e9a426ddaaeec91d3aae8155ae92eaf218f08d009caaecb
- MD5 1e1138a4613a8bd7e5d584063c4852b2
- SHA1 a17bdcd503c47cdf4ed6e7458534a9c5f7b5496b
- SHA512 8654f639891f69d1235d70de734d559888826468b06132eeda43bbec4b7c75a6555f2f7daccf69c44eb3cb8f0e98a37e47216a7961d45721538924a12af958c3
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup+9e2RU+2ks3z2OMDCRHqlm:A9iIxuERzA83h09RZxY+Z7saOMWRHqlm
- MD5 SHA1 SHA512 SSDEEP