Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 11:03
Static task
static1
Behavioral task
behavioral1
Sample
a533320d5669d6d4b4fe0c20d88611aa_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a533320d5669d6d4b4fe0c20d88611aa_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a533320d5669d6d4b4fe0c20d88611aa_JaffaCakes118.html
- Size 42KB
- Sample240613-m56ceswcma
- SHA256 b64d3099e5f324c7a50406e2f2636c73ae792fe0eba565254a0dc00c2b3c56ca
- MD5 a533320d5669d6d4b4fe0c20d88611aa
- SHA1 49abd4692161ebf472481645490750cc1e7096a3
- SHA512 0ccc90643b38fe696bfe6cf9728b99fc9a838be0b0c832e5e79dc4ba19c33a52335208a6941288bf7dff4e3150f971e7aa6ff0079212a821356cc99310ac9664
- SSDEEP 384:8Q/VZpxumgMkRpnL46Gx4vwtKWCnJ5j3fw7FhryTe6LB2vlaC/Z:2nL5Hkvx
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 548 msedge.exe 548 msedge.exe 3812 msedge.exe 3812 msedge.exe 4512 msedge.exe 4512 msedge.exe 4512 msedge.exe 4512 msedge.exe 2316 identity_helper.exe 2316 identity_helper.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe 3812 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3812 wrote to memory of 1360 3812 msedge.exe 81 PID 3812 wrote to memory of 1360 3812 msedge.exe 81 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 4704 3812 msedge.exe 83 PID 3812 wrote to memory of 548 3812 msedge.exe 84 PID 3812 wrote to memory of 548 3812 msedge.exe 84 PID 3812 wrote to memory of 4332 3812 msedge.exe 85 PID 3812 wrote to memory of 4332 3812 msedge.exe 85 PID 3812 wrote to memory of 4332 3812 msedge.exe 85 PID 3812 wrote to memory of 4332 3812 msedge.exe 85 PID 3812 wrote to memory of 4332 3812 msedge.exe 85 PID 3812 wrote to memory of 4332 3812 msedge.exe 85 PID 3812 wrote to memory of 4332 3812 msedge.exe 85 PID 3812 wrote to memory of 4332 3812 msedge.exe 85 PID 3812 wrote to memory of 4332 3812 msedge.exe 85 PID 3812 wrote to memory of 4332 3812 msedge.exe 85 PID 3812 wrote to memory of 4332 3812 msedge.exe 85 PID 3812 wrote to memory of 4332 3812 msedge.exe 85 PID 3812 wrote to memory of 4332 3812 msedge.exe 85 PID 3812 wrote to memory of 4332 3812 msedge.exe 85 PID 3812 wrote to memory of 4332 3812 msedge.exe 85 PID 3812 wrote to memory of 4332 3812 msedge.exe 85 PID 3812 wrote to memory of 4332 3812 msedge.exe 85 PID 3812 wrote to memory of 4332 3812 msedge.exe 85 PID 3812 wrote to memory of 4332 3812 msedge.exe 85 PID 3812 wrote to memory of 4332 3812 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a533320d5669d6d4b4fe0c20d88611aa_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97ed846f8,0x7ff97ed84708,0x7ff97ed847182⤵PID:1360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,10948484589982129568,14316501828268853548,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵PID:4704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,10948484589982129568,14316501828268853548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,10948484589982129568,14316501828268853548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10948484589982129568,14316501828268853548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:1920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10948484589982129568,14316501828268853548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,10948484589982129568,14316501828268853548,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10948484589982129568,14316501828268853548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 /prefetch:82⤵PID:320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10948484589982129568,14316501828268853548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10948484589982129568,14316501828268853548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:12⤵PID:1808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10948484589982129568,14316501828268853548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:12⤵PID:4628
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3600
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
- MD5 81e892ca5c5683efdf9135fe0f2adb15
- SHA1 39159b30226d98a465ece1da28dc87088b20ecad
- SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
- MD5 56067634f68231081c4bd5bdbfcc202f
- SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
- SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 2703688151cb56a868f3bc3b5b9de541474c4a231d63f5a9912a76f5008db0cc
- MD5 9d23ca7ba51d36adc1c7e4d78fd8851c
- SHA1 c4d02166dc9ca44961a3ef5f95a7c4566e8df079
- SHA512 f9e23af1f6a8db5e139f7f40ea32ab55b82620614c2062ed012bc61e768f2b1646438cd220381630e8872d27a0e3f78f14df762b03fa31f6f5c0b0b93bfa9ab8
- SSDEEP 96:nw8kBoxm/DQYmqAh1w3UcwpvWMoiVmdeHIqQVK4uUWQyV+VDCziEwb:nw8krIBhK3UcGWMXdcK4uro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 1b969245a69ec000d87d22eec80bf24aec7c15911e041e7e520a836da7010e34
- MD5 6f9004719bfbac5f0b0b0496b732a4fb
- SHA1 a30b1fe48ab6213bafe7ce6934f5993ce8c8c559
- SHA512 3099c6e1fe69a0fa69fae78912a55e1e7a5245eafd6466ee53ba899d5a6d568679efaaf67a3b85b7bab8163e13f436d74d2abe580c086a0df1cfe3c1b8433738
- SSDEEP 96:nw8kBoxm/DnmqAh1w3UcwpvWMoiVmdeHIqQVK4uUWQyV+VDCAiEwb:nw8kr6BhK3UcGWMXdcK4urV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 157ae317ef29f029ee75239d2edfb4c177c2f28a60fa3b1c6b67b03c87ec0f81
- MD5 a3149f321d9f60278cfe7ff3b0974629
- SHA1 0a9d65ca36c482c97cdd93ca638fa18745aba956
- SHA512 0b768c2ca46c89ac6922cf06647cf381e192157c4ddff3f0e1f0be4e58ddefe414d03c71c49314647a35714ca6b161e9677da3a5f8aa5ea3dfb3cd396fd1e8d5
- SSDEEP 96:nw8kBoxm/DnmqAh1w3UiwpvWMoiVmdeHIqQVK4uUWQyV+VDCAiEwb:nw8kr6BhK3UiGWMXdcK4urV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 ce35a9cad676d3f3febaabde65380389defced0b1576f900f7abe4f8a1d480bd
- MD5 a5e24ef6796f4ffeaf4a937c21c2f496
- SHA1 273a6952340f17c05a771800c5a62c1f75fdfc4e
- SHA512 219df39750d7fefea655823ca1526d2e008e49bbf276b8e176ef0b4288ba71d7f9e7ed0ab53c8a320b6a467561c36af722698ae80b1b589c1d17496e5d0ff7f7
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupM3p0JYe2RUmDCdvRF3z2Oq:A9iIxuERzA83h09RZxYMGJWjDORFaOMz
- MD5 SHA1 SHA512 SSDEEP