Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 07:06
Static task
static1
Behavioral task
behavioral1
Sample
a45a00728c1311df0006713a7e7d1d8d_JaffaCakes118.html
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
a45a00728c1311df0006713a7e7d1d8d_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a45a00728c1311df0006713a7e7d1d8d_JaffaCakes118.html
- Size 58KB
- Sample240613-hxesaasfmj
- SHA256 b1260863677c42b8e25f9656e0c5d34202f1ef396b844090ff1a5e65467a7b02
- MD5 a45a00728c1311df0006713a7e7d1d8d
- SHA1 70ed81331cae0b1be0b9910d314a8fb321823074
- SHA512 8e316d6347815fb803853518b0716b4b334394e5db88c8c006fff4c6f63ea44d6fe6b49fd25233157da29fe22a07108acc2db99b06b89808fd73b644fe8b756c
- SSDEEP 768:6yGoyC9Fm7Q8CPxJOLkVBqyxqpP8rifCk3WwoGr5Sf4u0QueHFHc0woAMOUJIUe/:IC9Fm7Q8CPx3P02HFHceYHnsPKIk
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4028 msedge.exe 4028 msedge.exe 4432 msedge.exe 4432 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4432 msedge.exe 4432 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe 4432 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4432 wrote to memory of 4628 4432 msedge.exe 81 PID 4432 wrote to memory of 4628 4432 msedge.exe 81 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4996 4432 msedge.exe 83 PID 4432 wrote to memory of 4028 4432 msedge.exe 84 PID 4432 wrote to memory of 4028 4432 msedge.exe 84 PID 4432 wrote to memory of 4412 4432 msedge.exe 85 PID 4432 wrote to memory of 4412 4432 msedge.exe 85 PID 4432 wrote to memory of 4412 4432 msedge.exe 85 PID 4432 wrote to memory of 4412 4432 msedge.exe 85 PID 4432 wrote to memory of 4412 4432 msedge.exe 85 PID 4432 wrote to memory of 4412 4432 msedge.exe 85 PID 4432 wrote to memory of 4412 4432 msedge.exe 85 PID 4432 wrote to memory of 4412 4432 msedge.exe 85 PID 4432 wrote to memory of 4412 4432 msedge.exe 85 PID 4432 wrote to memory of 4412 4432 msedge.exe 85 PID 4432 wrote to memory of 4412 4432 msedge.exe 85 PID 4432 wrote to memory of 4412 4432 msedge.exe 85 PID 4432 wrote to memory of 4412 4432 msedge.exe 85 PID 4432 wrote to memory of 4412 4432 msedge.exe 85 PID 4432 wrote to memory of 4412 4432 msedge.exe 85 PID 4432 wrote to memory of 4412 4432 msedge.exe 85 PID 4432 wrote to memory of 4412 4432 msedge.exe 85 PID 4432 wrote to memory of 4412 4432 msedge.exe 85 PID 4432 wrote to memory of 4412 4432 msedge.exe 85 PID 4432 wrote to memory of 4412 4432 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a45a00728c1311df0006713a7e7d1d8d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a24f46f8,0x7ff9a24f4708,0x7ff9a24f47182⤵PID:4628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,15201111676980538074,13653698672291342149,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:4996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,15201111676980538074,13653698672291342149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,15201111676980538074,13653698672291342149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:82⤵PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15201111676980538074,13653698672291342149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15201111676980538074,13653698672291342149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:2092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,15201111676980538074,13653698672291342149,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4016 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4084
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5076
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
- MD5 dabfafd78687947a9de64dd5b776d25f
- SHA1 16084c74980dbad713f9d332091985808b436dea
- SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
- MD5 c39b3aa574c0c938c80eb263bb450311
- SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
- SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 41c28b1bec126a2f603ea6dc2df65dc43ec31b5774719431be4dfd3cebef7557
- MD5 5bee684b39f8f0f3f9e2442bf9b9c1ad
- SHA1 7d90a09dbf2e199c22ad6cf653edea618d8ee801
- SHA512 72355136710df37e5e55985f940e6f8b776e14b8765fff19e6977d26f39de8149be18fbf0a87fd12abf2ee0bb60dcee76105d272d53ba0c745f762219a500eb1
- SSDEEP 96:n2RFkloxm/DQYmqk1OemwpvWMoiVmdeH1DR8+UWQyV+VDCziEwb:n2RFkPIXsemGWMXM+ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 33d34c3f33de03818f21df6c1f37e3e30104c5f1d883f6d15380c301566b6ae0
- MD5 4db4c3de85b420a8b0fbd502836491ec
- SHA1 cde7ec9362c84bf15631596d7d02a5825dab42cb
- SHA512 18d992b41534b3dcb020226218adc09ae09832455148dfb5f5331562584934ce2843fc02ea6b947b4c95f29a63654ccb9980c28aeb544d0f15e3a727b2a313c6
- SSDEEP 96:n2RFkloxm/Dnmqk1OemwpvWMoiVmdeH1DR8+UWQyV+VDCAiEwb:n2RFkP6XsemGWMXM+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 0048cc3562b03e39c991f75f6c7f188b118484b0c75b5d4a1459a04198caf91a
- MD5 aeedcff9b622c97b0dffd8612cb8858d
- SHA1 b2868d80db0b5d43635b32c42203fef36291210d
- SHA512 04cd66b64628377773884cd56895f955af23f777aa228df5134faa68fd62754363208825e5e292ccc233ee6c1e9db1615635fd9f3a78bfe45430621fe10c56af
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup57Qe2RUoKSRsm3z2OMDCR9:A9iIxuERzA83h09RZxYcjNGmaOMWRHqm
- MD5 SHA1 SHA512 SSDEEP