Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 07:28
Static task
static1
Behavioral task
behavioral1
Sample
a46ce0be673a00105334afef7ea6c149_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a46ce0be673a00105334afef7ea6c149_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a46ce0be673a00105334afef7ea6c149_JaffaCakes118.html
- Size 139KB
- Sample240613-jaysbatbmm
- SHA256 584a3efdd20a682147e0d07e6460a769efeb4886a491e4a9804a597105aec081
- MD5 a46ce0be673a00105334afef7ea6c149
- SHA1 eab9554df9e4302cf3199152c98104925e51b3ba
- SHA512 d173c674411af2326daec7760de02b956f335482e8c9328b9cc322a8a97cac8d584edd44569137ef855c2f636861733dd03c16209f1a6f94bd69f9d997320536
- SSDEEP 1536:S49N0aKvXzlmsbyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:S49q4sbyfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4444 msedge.exe 4444 msedge.exe 812 msedge.exe 812 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 812 msedge.exe 812 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe 812 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 812 wrote to memory of 1840 812 msedge.exe 82 PID 812 wrote to memory of 1840 812 msedge.exe 82 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 2824 812 msedge.exe 83 PID 812 wrote to memory of 4444 812 msedge.exe 84 PID 812 wrote to memory of 4444 812 msedge.exe 84 PID 812 wrote to memory of 5044 812 msedge.exe 85 PID 812 wrote to memory of 5044 812 msedge.exe 85 PID 812 wrote to memory of 5044 812 msedge.exe 85 PID 812 wrote to memory of 5044 812 msedge.exe 85 PID 812 wrote to memory of 5044 812 msedge.exe 85 PID 812 wrote to memory of 5044 812 msedge.exe 85 PID 812 wrote to memory of 5044 812 msedge.exe 85 PID 812 wrote to memory of 5044 812 msedge.exe 85 PID 812 wrote to memory of 5044 812 msedge.exe 85 PID 812 wrote to memory of 5044 812 msedge.exe 85 PID 812 wrote to memory of 5044 812 msedge.exe 85 PID 812 wrote to memory of 5044 812 msedge.exe 85 PID 812 wrote to memory of 5044 812 msedge.exe 85 PID 812 wrote to memory of 5044 812 msedge.exe 85 PID 812 wrote to memory of 5044 812 msedge.exe 85 PID 812 wrote to memory of 5044 812 msedge.exe 85 PID 812 wrote to memory of 5044 812 msedge.exe 85 PID 812 wrote to memory of 5044 812 msedge.exe 85 PID 812 wrote to memory of 5044 812 msedge.exe 85 PID 812 wrote to memory of 5044 812 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a46ce0be673a00105334afef7ea6c149_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcac9d46f8,0x7ffcac9d4708,0x7ffcac9d47182⤵PID:1840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,18346319297804903741,675782082209440173,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:2824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,18346319297804903741,675782082209440173,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,18346319297804903741,675782082209440173,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:82⤵PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,18346319297804903741,675782082209440173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:3460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,18346319297804903741,675782082209440173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:3588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,18346319297804903741,675782082209440173,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3112 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3432
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2432
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6bf38c89-da63-4841-a8bf-e7305eb4f03c.tmp
- Size 11KB
- SHA256 ce3a8952a55890eac5f2b91e7419f8a9cb680ca397ebfbcf30f793369d74e33e
- MD5 1bbf82e86cf9bbdb6df6673e900f168d
- SHA1 32a3f951d9acf3c6cd967f1fc3132fcb12a89106
- SHA512 e915cd4d99e9622a8ac6b4a6978d1deb036be779751664fd4d70b9943c58287c6f4f1785d6c328e09fe16913a916680ffc0213bb960f114b848a63e1d53e76fc
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupqHfTe2RU+h/V3z2OMDCRHZ:A9iIxuERzA83h09RZxY4blVaOMWRHql8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
- MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
- SHA1 86174e670c44767c08a39cc2a53c09c318326201
- SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
- MD5 b704c9ca0493bd4548ac9c69dc4a4f27
- SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
- SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 d4cb9fb44c8d69dbb67624b52d2edce4b393cbb295cb3685c79ed86e43a119ab
- MD5 1a8822a6102f7d4e8098b647ee461a7e
- SHA1 d4b88b8c4e444379290d300e9db66ea14b61b9ae
- SHA512 a31318725cd6a46a8fe246dab4c15d705c77323dca0000ac0d6cf75bdc6c9a127011b29d5d7701dd04b2ac068bc357dd7b0a7a084b23d7b0cb5fb7960a2cb834
- SSDEEP 96:nKk/oxm/DQYmqC1P7vwpvWMoiVmdeH2WfRUWQyV+VDCziEwb:nKkBIBR7vGWMXBro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 2ae93dfc3e14e58b7d0973fa331d6f5199d6d492dabc9794d0ee0db6ed662c42
- MD5 8af1b230c3b38c28c84d7134dfcb4160
- SHA1 046c13ebf06cc30d9af3e938b7a0b105fbb4b6c8
- SHA512 27d1c0141b49c8539e93c5ee7da196302e0a247df1cf02a7ebe21abbbb6910a9b162b7e30b0b41625bdaf873f9be8aef5e04942b025d163bca4765ab47032b22
- SSDEEP 96:nKk/oxm/DnmqC1P7KwpvWMoiVmdeH2WfRUWQyV+VDCAiEwb:nKkB6BR7KGWMXBrV
- MD5 SHA1 SHA512 SSDEEP