Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 08:55
Static task
static1
Behavioral task
behavioral1
Sample
a4b9d365518ad0ccb6c58f75950b59c7_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a4b9d365518ad0ccb6c58f75950b59c7_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a4b9d365518ad0ccb6c58f75950b59c7_JaffaCakes118.html
- Size 139KB
- Sample240613-kvmffswarn
- SHA256 8b1471f47c9de25a16e8b66a501797de0f76578a8c314d6217a0b4ec46d02240
- MD5 a4b9d365518ad0ccb6c58f75950b59c7
- SHA1 00b1cea8c9bcb8e6dce82e3fc6b6ca677cf77950
- SHA512 1ba33d36b41c6c89649b34e79f838547de250580a3262f6bf04de1ca4181a8d26ba999df66d81e925a2394764187dffc4c24c95b6676de25b30c8cf0cdbd4222
- SSDEEP 1536:SvlizUloCSyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:SvpSyfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 3828 msedge.exe 3828 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3128 msedge.exe 3128 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe 3128 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3128 wrote to memory of 4280 3128 msedge.exe 82 PID 3128 wrote to memory of 4280 3128 msedge.exe 82 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3928 3128 msedge.exe 84 PID 3128 wrote to memory of 3828 3128 msedge.exe 85 PID 3128 wrote to memory of 3828 3128 msedge.exe 85 PID 3128 wrote to memory of 3940 3128 msedge.exe 86 PID 3128 wrote to memory of 3940 3128 msedge.exe 86 PID 3128 wrote to memory of 3940 3128 msedge.exe 86 PID 3128 wrote to memory of 3940 3128 msedge.exe 86 PID 3128 wrote to memory of 3940 3128 msedge.exe 86 PID 3128 wrote to memory of 3940 3128 msedge.exe 86 PID 3128 wrote to memory of 3940 3128 msedge.exe 86 PID 3128 wrote to memory of 3940 3128 msedge.exe 86 PID 3128 wrote to memory of 3940 3128 msedge.exe 86 PID 3128 wrote to memory of 3940 3128 msedge.exe 86 PID 3128 wrote to memory of 3940 3128 msedge.exe 86 PID 3128 wrote to memory of 3940 3128 msedge.exe 86 PID 3128 wrote to memory of 3940 3128 msedge.exe 86 PID 3128 wrote to memory of 3940 3128 msedge.exe 86 PID 3128 wrote to memory of 3940 3128 msedge.exe 86 PID 3128 wrote to memory of 3940 3128 msedge.exe 86 PID 3128 wrote to memory of 3940 3128 msedge.exe 86 PID 3128 wrote to memory of 3940 3128 msedge.exe 86 PID 3128 wrote to memory of 3940 3128 msedge.exe 86 PID 3128 wrote to memory of 3940 3128 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4b9d365518ad0ccb6c58f75950b59c7_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb4c7b46f8,0x7ffb4c7b4708,0x7ffb4c7b47182⤵PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,8280881386205541458,68439943069115176,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,8280881386205541458,68439943069115176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,8280881386205541458,68439943069115176,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:82⤵PID:3940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8280881386205541458,68439943069115176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8280881386205541458,68439943069115176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,8280881386205541458,68439943069115176,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3652
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:388
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
- MD5 c5abc082d9d9307e797b7e89a2f755f4
- SHA1 54c442690a8727f1d3453b6452198d3ec4ec13df
- SHA512 ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
- MD5 b4a74bc775caf3de7fc9cde3c30ce482
- SHA1 c6ed3161390e5493f71182a6cb98d51c9063775d
- SHA512 55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 7f48105e5e81bff175b469d01a55411e5b621f432b5615126b42e7449f568c63
- MD5 af27ec2dca6452a6dcfb6d0e6c1dea08
- SHA1 616f1b8c6ab37a7e01cbf82034474ed51bca1701
- SHA512 fae273ddec84a07d7fd00bb085804a71dd4ab20897c1b158198d898ebd469857359c6f3d2824cc6bed56af57e98942497deee46070682edad1973134192cdcd9
- SSDEEP 96:nTk/oxm/DnmqK1SneEcwpvWMoiVmdeHna3UWQyV+VDCAiEwb:nTkB6R4nebGWMXgrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 eadeaa638c2009b427f0c0ce46d8adabe445b7b3cc476a2ce5d759ed9369a9cd
- MD5 9f1569dc41ec5c00add0b2a4fc09c58c
- SHA1 e7ec069aafce3d19aa95edb89258af7722f973fe
- SHA512 478e4fa7d7377eb5c8580391e4246d685e25c4e1c9818261b0b4361ba618ae3ccb2c5dc8c23d6b784e57b981ad21387f8a879459320dd6bfd8aae87bd5e204a3
- SSDEEP 96:nTk/oxm/DQYmqK1SEeEcwpvWMoiVmdeHna3UWQyV+VDCziEwb:nTkBIR4EebGWMXgro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 853711bd04c6f6a6f7f6f658bf942f3f26edf0351607119f6980f375c9206145
- MD5 5e032fe187b14dac6aa0eafcf7e33f47
- SHA1 abc11ac3310c00031b6be2f318f2e3aa92c93d32
- SHA512 ce183af421e7bc5cd86970bff6afaf4304cbc44cd09792e3acae6594f048d630b750fdd9646609c01c72e1bf1953020f4fe252ba0b0e47bb67ca192581a2cde2
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupxS0e2RU/9ta3z2OMDCRHqW:A9iIxuERzA83h09RZxYg6maaOMWRHqlE
- MD5 SHA1 SHA512 SSDEEP