Analysis
- max time kernel
145s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 06:33
Static task
static1
Behavioral task
behavioral1
Sample
a4397efc329b943be6f82f20095a7e60_JaffaCakes118.html
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a4397efc329b943be6f82f20095a7e60_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a4397efc329b943be6f82f20095a7e60_JaffaCakes118.html
- Size 139KB
- Sample240613-hbbthaxepc
- SHA256 de3635e5282681dac7e251d8b5ebd8d1139a55286b34f5694607a264a4e3a55c
- MD5 a4397efc329b943be6f82f20095a7e60
- SHA1 5d729cc1323ab8787b5e8f4ca53289face6aa3b2
- SHA512 91a15073d26a01f03223b83ac42288259699c5604b1fe50fb355265959ee0ca5f50d58b7190179eda81e8472cf93bc77d0c570ed63b9e99f04ad771350b6ac85
- SSDEEP 3072:SS8lK49LVTuAgITNfmX5wz2+Frr2PWzzs+ifp8rX:SFlK9Jkrs/+i6rX
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 4040 msedge.exe 4040 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe 3020 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2696 msedge.exe 2696 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2696 wrote to memory of 1716 2696 msedge.exe 88 PID 2696 wrote to memory of 1716 2696 msedge.exe 88 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 3572 2696 msedge.exe 89 PID 2696 wrote to memory of 4040 2696 msedge.exe 90 PID 2696 wrote to memory of 4040 2696 msedge.exe 90 PID 2696 wrote to memory of 4564 2696 msedge.exe 91 PID 2696 wrote to memory of 4564 2696 msedge.exe 91 PID 2696 wrote to memory of 4564 2696 msedge.exe 91 PID 2696 wrote to memory of 4564 2696 msedge.exe 91 PID 2696 wrote to memory of 4564 2696 msedge.exe 91 PID 2696 wrote to memory of 4564 2696 msedge.exe 91 PID 2696 wrote to memory of 4564 2696 msedge.exe 91 PID 2696 wrote to memory of 4564 2696 msedge.exe 91 PID 2696 wrote to memory of 4564 2696 msedge.exe 91 PID 2696 wrote to memory of 4564 2696 msedge.exe 91 PID 2696 wrote to memory of 4564 2696 msedge.exe 91 PID 2696 wrote to memory of 4564 2696 msedge.exe 91 PID 2696 wrote to memory of 4564 2696 msedge.exe 91 PID 2696 wrote to memory of 4564 2696 msedge.exe 91 PID 2696 wrote to memory of 4564 2696 msedge.exe 91 PID 2696 wrote to memory of 4564 2696 msedge.exe 91 PID 2696 wrote to memory of 4564 2696 msedge.exe 91 PID 2696 wrote to memory of 4564 2696 msedge.exe 91 PID 2696 wrote to memory of 4564 2696 msedge.exe 91 PID 2696 wrote to memory of 4564 2696 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4397efc329b943be6f82f20095a7e60_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb18af46f8,0x7ffb18af4708,0x7ffb18af47182⤵PID:1716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,15783077876682254572,3119065157893613652,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:3572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,15783077876682254572,3119065157893613652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,15783077876682254572,3119065157893613652,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:82⤵PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15783077876682254572,3119065157893613652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:12⤵PID:4168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15783077876682254572,3119065157893613652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:12⤵PID:2280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,15783077876682254572,3119065157893613652,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3020
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:816
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 8185c36aaacfc71e42f94fad8e198fe7fb2d868398ceabb89261cae94341cb22
- MD5 257c0005d0c4d0bb282cb470925e4376
- SHA1 f9b8efb511ed64292568977c9f2ec255509e8f7d
- SHA512 2f3e8f352ed3ef88e8c28650390f93f98c92174d268330b886f3ebd1ba0163999051298ee12a054606b4986005452a241c6864cd292e69492d79c37d500556f4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 05e479e8ec96b7505e01e5ec757ccfe35cb73cd46b27ff4746dce90d43d9237c
- MD5 4819fbc4513c82d92618f50a379ee232
- SHA1 ab618827ff269655283bf771fc957c8798ab51ee
- SHA512 bc24fb972d04b55505101300e268f91b11e5833f1a18e925b5ded7e758b5e3e08bee1aa8f3a0b65514d6df981d0cbfa8798344db7f2a3675307df8de12ae475b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7f91a76f-3927-4e40-81f7-e1366aa89b9a.tmp
- Size 5KB
- SHA256 e003fca61d4dfadda67c55adb337b2d863f8b7080c4ffac21ab5e071faf069b7
- MD5 791400bb7b8dc8a47bf4452531a977f8
- SHA1 4271cb87fe25ccd635c7e5c2bf2d9c77f84dd8f2
- SHA512 6a63875f2b061cd9d806b18e47dabf9842dc48414d15912563f7c9c5db274740fc026d207ae181436030c923e0e30a2aea5a4d96f562f12963d3af18b13b7bbc
- SSDEEP 96:nZskIYgm/DQYmqpe1NZwpvWMoiVmdeH2WfnUWQyV+VDCziEwb:n+kRIL3ZGWMXXro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 111B
- SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
- MD5 807419ca9a4734feaf8d8563a003b048
- SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
- SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 266B
- SHA256 c7935c2e71e9ad736655c8d83a9a19b76ee3e3c38873b9b2b58f85e51519ad29
- MD5 d9b1f04bc5db503ae45aa524b454f4ba
- SHA1 703fc30acbfd6a795029c2a85c1323c688445bcc
- SHA512 8ef02d590aa5fee3767567ae0326cfcd37e97056ab736889b2486428b0dd806c984ec121147130889cb3533eba60219e0afb0e762d7556c0a5e16252d25fc901
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 7a878199d336bcaf88866c670d8b5b60778f71973e9e64efa6d5793c9aca050a
- MD5 c85f581bfe7e565d61fb81f13dedd819
- SHA1 54814b6d7cc00a9fe0be057db36f8099fe13447d
- SHA512 f502cf9c50916ab3bcfee792e3ecdf91d08a41fcb833e6017a90fb16ca157d44821cfe2c6ff45102f248f908d34cd1facc879eb8f32b000588f2f551f227f229
- SSDEEP 96:nZskIYgm/Dnmqpe1NZwpvWMoiVmdeH2WfnUWQyV+VDCAiEwb:n+kR6L3ZGWMXXrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 92355980e3dad75e132ca93ec1e2c9c95069bc4af1e4b06b19cfd769b3ccc8d4
- MD5 46d92def094ca87ae6eb44a566d26c0c
- SHA1 ce09f1d365dade89c9fd8ce5306e877dfe071942
- SHA512 a55764a79d6d5ba71cb5c0b4d3ce12817ce513306056b3f4cea84796647ec5c570b66b8971578237e092b84c2ce7748f4b330f18b030166b87399b24bc7c2bbe
- SSDEEP 96:nZskIYgm/Dnmqpe1NwwpvWMoiVmdeH2WfnUWQyV+VDCAiEwb:n+kR6L3wGWMXXrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 24KB
- SHA256 d58162c5ae5e18fc06604c285e024c01686093d70994dc93b4ae9d85b4c3f7b9
- MD5 95cd1581c30a5c26f698a8210bcab430
- SHA1 5e8e551a47dd682ec51a7d6808fe8e0f2af39e86
- SHA512 e49403df10177053634c431203a91d26df5dfb23cbbb88847459ecdf4b6107040d0944a3e84ee6bb26cb4e8017a35c8c31b658387cd1b6938ba4cb9f59606ece
- SSDEEP 768:ntEW/l8F1+UoAYDCx9Tuqh0VfUC9xbog/OVHLlj2rUr2A:ntEW/lu1ja2L/rL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 eaee26fd5b45860ca94e829354fb7026e6d0c8d4a9faf541f5711e8441aa2c84
- MD5 33cd5831fa625ac918527a91f42c74c0
- SHA1 66f90c1c459817b2c7bbd027025ba3965c746964
- SHA512 0d844b4b4d9aa8a117f0f50992263934f3bb5bbfcf5a522cee99e20ca8a877bdf3bce934253e948035a2894a1d3d098b8e153e7fe9ede7715a6b91ebd8566feb
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupkHfHde2RUXh/W3z2OMDCRX:A9iIxuERzA83h09RZxYOv5SWaOMWRHqO
- MD5 SHA1 SHA512 SSDEEP