Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 07:48
Static task
static1
Behavioral task
behavioral1
Sample
a47df740515100adb1bf86752d111e9a_JaffaCakes118.html
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a47df740515100adb1bf86752d111e9a_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a47df740515100adb1bf86752d111e9a_JaffaCakes118.html
- Size 211KB
- Sample240613-jm45vsteqk
- SHA256 26b3cd5c33ed402274233bbfd8341117ba2cde6e4399e08bbfab284581ddaae8
- MD5 a47df740515100adb1bf86752d111e9a
- SHA1 27eb4779e9d3544db6db3d3c75e93d686e0d8425
- SHA512 3b52e58639a8cec1ed8a0e4cdaeb01df1036c2bc595a051f172635f0bb9a3e771cf61cfb26af7dab5f8c3672327852cc6dbf1f19e6cc3d6d8f4ff2ff3de2e2f7
- SSDEEP 3072:SlDDFIkgxyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFis:SpxrsMYod+X3oI+Yn86/U9jFis
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1276 msedge.exe 1276 msedge.exe 5092 msedge.exe 5092 msedge.exe 4264 msedge.exe 4264 msedge.exe 4264 msedge.exe 4264 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5092 msedge.exe 5092 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5092 wrote to memory of 2924 5092 msedge.exe 81 PID 5092 wrote to memory of 2924 5092 msedge.exe 81 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 3188 5092 msedge.exe 82 PID 5092 wrote to memory of 1276 5092 msedge.exe 83 PID 5092 wrote to memory of 1276 5092 msedge.exe 83 PID 5092 wrote to memory of 4452 5092 msedge.exe 84 PID 5092 wrote to memory of 4452 5092 msedge.exe 84 PID 5092 wrote to memory of 4452 5092 msedge.exe 84 PID 5092 wrote to memory of 4452 5092 msedge.exe 84 PID 5092 wrote to memory of 4452 5092 msedge.exe 84 PID 5092 wrote to memory of 4452 5092 msedge.exe 84 PID 5092 wrote to memory of 4452 5092 msedge.exe 84 PID 5092 wrote to memory of 4452 5092 msedge.exe 84 PID 5092 wrote to memory of 4452 5092 msedge.exe 84 PID 5092 wrote to memory of 4452 5092 msedge.exe 84 PID 5092 wrote to memory of 4452 5092 msedge.exe 84 PID 5092 wrote to memory of 4452 5092 msedge.exe 84 PID 5092 wrote to memory of 4452 5092 msedge.exe 84 PID 5092 wrote to memory of 4452 5092 msedge.exe 84 PID 5092 wrote to memory of 4452 5092 msedge.exe 84 PID 5092 wrote to memory of 4452 5092 msedge.exe 84 PID 5092 wrote to memory of 4452 5092 msedge.exe 84 PID 5092 wrote to memory of 4452 5092 msedge.exe 84 PID 5092 wrote to memory of 4452 5092 msedge.exe 84 PID 5092 wrote to memory of 4452 5092 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a47df740515100adb1bf86752d111e9a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe197b46f8,0x7ffe197b4708,0x7ffe197b47182⤵PID:2924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,7116022424196940455,5889487556106433502,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:3188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,7116022424196940455,5889487556106433502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,7116022424196940455,5889487556106433502,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:4452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7116022424196940455,5889487556106433502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:4580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7116022424196940455,5889487556106433502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,7116022424196940455,5889487556106433502,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5008 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4264
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1388
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
- MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
- SHA1 86174e670c44767c08a39cc2a53c09c318326201
- SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
- MD5 b704c9ca0493bd4548ac9c69dc4a4f27
- SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
- SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 576bd8dd570546a1b593a1d81edd315dc0bbe5c9c955b8b13386c487faed09c4
- MD5 34d6fe1436493fcd2b7d4947679de776
- SHA1 7f2abf7c880b982ac5928f22b417406816bd3574
- SHA512 798dfdabc2e3a26e380fb228ff26ca38b7896ed7aced127b650205fe9700be3d2996b548ae7495f709da0cc52b7e047fc315d8a944d645274e7d6f541e5fbfbc
- SSDEEP 96:nwk/oxm/Dnmq61RKwpvWMoiVmdeH2WfDVUWQyV+VDCAiEwb:nwkB6hrKGWMXTVrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 6e519d2011c740f60f72b8db93d0bbb93a2bac4b0f5c5959d5a613260a394065
- MD5 9c40c021259b50bd1a4d115e3339083c
- SHA1 a57fc8c82f07aa198e6f9779f148c38265b0da58
- SHA512 8ff4f5f028118ab667512ef7a2c1b10db0717b10c8203643c27bb9ebb61296b1d53db7b397dcb27ea0fe798238737afb5962ef51404ad5c590237e92e30d219d
- SSDEEP 96:nwk/oxm/DQYmq61RvwpvWMoiVmdeH2WfDVUWQyV+VDCziEwb:nwkBIhrvGWMXTVro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 fea1cbedb6b8edd37ed426cdab029611bbc8818043aa86a4ccf068293d4800c8
- MD5 43745da2bcb85a4d05cea527eda99d06
- SHA1 bf2def9a57ddf1ebe573afac568d35f9c8633ff6
- SHA512 f6422bc7b172800d2540d5fec16d9624bcec1fcca91912822b6ba443e6693c9bc0feb7af3b259924d3b66a18bd0ad9be04b870a4c959812dc8a424c90d81d95e
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupdHf7e2RUih/j3z2OMDCRHn:A9iIxuERzA83h09RZxYRTZjaOMWRHqlu
- MD5 SHA1 SHA512 SSDEEP