Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 07:47
Static task
static1
Behavioral task
behavioral1
Sample
a47daf48bfda4c627e247504954af084_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a47daf48bfda4c627e247504954af084_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a47daf48bfda4c627e247504954af084_JaffaCakes118.html
- Size 159KB
- Sample240613-jmtdcszdkc
- SHA256 d69a62f2aa872f1f2146b1c2cb679d198abe4cad5cb24f1dd87092070ccd02fb
- MD5 a47daf48bfda4c627e247504954af084
- SHA1 88f881c0511ddbb1de276fca0f038210582b67ad
- SHA512 cdaf90f949671e18ffb9cca2f8ab838a2edc39cdbadaa2b0b64505292d9ffe5064e6f2727488f93c1a825df69a724b7ca9ead2a9e02c6b22dbdc6ce005b3a770
- SSDEEP 1536:Sdkt8J3Z6mlhLgn/yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:SdtJ3li/yfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1344 msedge.exe 1344 msedge.exe 4000 msedge.exe 4000 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe 3920 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4000 msedge.exe 4000 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4000 wrote to memory of 3060 4000 msedge.exe 81 PID 4000 wrote to memory of 3060 4000 msedge.exe 81 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 4872 4000 msedge.exe 82 PID 4000 wrote to memory of 1344 4000 msedge.exe 83 PID 4000 wrote to memory of 1344 4000 msedge.exe 83 PID 4000 wrote to memory of 4792 4000 msedge.exe 84 PID 4000 wrote to memory of 4792 4000 msedge.exe 84 PID 4000 wrote to memory of 4792 4000 msedge.exe 84 PID 4000 wrote to memory of 4792 4000 msedge.exe 84 PID 4000 wrote to memory of 4792 4000 msedge.exe 84 PID 4000 wrote to memory of 4792 4000 msedge.exe 84 PID 4000 wrote to memory of 4792 4000 msedge.exe 84 PID 4000 wrote to memory of 4792 4000 msedge.exe 84 PID 4000 wrote to memory of 4792 4000 msedge.exe 84 PID 4000 wrote to memory of 4792 4000 msedge.exe 84 PID 4000 wrote to memory of 4792 4000 msedge.exe 84 PID 4000 wrote to memory of 4792 4000 msedge.exe 84 PID 4000 wrote to memory of 4792 4000 msedge.exe 84 PID 4000 wrote to memory of 4792 4000 msedge.exe 84 PID 4000 wrote to memory of 4792 4000 msedge.exe 84 PID 4000 wrote to memory of 4792 4000 msedge.exe 84 PID 4000 wrote to memory of 4792 4000 msedge.exe 84 PID 4000 wrote to memory of 4792 4000 msedge.exe 84 PID 4000 wrote to memory of 4792 4000 msedge.exe 84 PID 4000 wrote to memory of 4792 4000 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a47daf48bfda4c627e247504954af084_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb60b546f8,0x7ffb60b54708,0x7ffb60b547182⤵PID:3060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,995552557355340013,5274914796457973096,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:4872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,995552557355340013,5274914796457973096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,995552557355340013,5274914796457973096,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,995552557355340013,5274914796457973096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:2752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,995552557355340013,5274914796457973096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,995552557355340013,5274914796457973096,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3920
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3748
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
- MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
- SHA1 86174e670c44767c08a39cc2a53c09c318326201
- SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
- MD5 b704c9ca0493bd4548ac9c69dc4a4f27
- SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
- SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 cf526ee8d2c7a0c306549ecc3b7f7b76996cf305d777aea5346e6b1df68fa085
- MD5 a6acbf9ba933038afc69172076e66d8d
- SHA1 9aad253423d1d9397556ef74d30a36268ed266ba
- SHA512 3aa73f39ebbc2d3d9e6d5b4532085443ba676026fd1a623a99b0dc07d15875dca46a993c440116a3b0c97cc986d1dd10ccbd3e83e247af8c6fe9e9faa48e3110
- SSDEEP 96:npk/oxm/Dnmql1bKwpvWMoiVmdeH2WfaAUWQyV+VDCAiEwb:npkB6SdKGWMXqArV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 1627a159efe0efa748dfcecf5753f34c0574bf53e585a599529adfd30f94f3d7
- MD5 f32d52ad77f6fe6dd4e9d748e6be20e3
- SHA1 4f74eb9f8c6db6c1dd7396b2ae72afaa71a53b79
- SHA512 6dca756311279714a2eda7bcf50ab305a1725b790f5d33ff938354e1e3ab5df51bb123168e2b8374ffdcbd0735ee9ca88e4863b84a4bda33ac79c66d808f8724
- SSDEEP 96:npk/oxm/DQYmql1bvwpvWMoiVmdeH2WfaAUWQyV+VDCziEwb:npkBISdvGWMXqAro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 97a5220544205a8df2ac2bdd18bb195cf829ffc5f0daffa83db642b5b975ef34
- MD5 ee5d6d03adadbbfbe6d89aa2585f1999
- SHA1 f06890de07aa15dbc02c6824ae82149e22cd62d5
- SHA512 516ea58155dc0036a1f2ddcfe3eefe40afea6df2c911bcd7ddbb1770630c5646847c227603d13fb36bd8bcf1e2b80ce0ae38b2f518bdbe43daf95c950b26b8c9
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDOHfje2RUih/23z2OMDCRD:A9iIxuERzA83h09RZxYD0L52aOMWRHqY
- MD5 SHA1 SHA512 SSDEEP