Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 10:25
Static task
static1
Behavioral task
behavioral1
Sample
a5124275c17b6ea2c8064b4f2b92cf8d_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a5124275c17b6ea2c8064b4f2b92cf8d_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a5124275c17b6ea2c8064b4f2b92cf8d_JaffaCakes118.html
- Size 75KB
- Sample240613-mf433ayenk
- SHA256 f4faa0de0f6d96f7587df55de0263023bac4dcd8ab0c6f6de5462b37d2a1bf42
- MD5 a5124275c17b6ea2c8064b4f2b92cf8d
- SHA1 4de262efe95544056178d9ccac9b7b2f9e707efd
- SHA512 101b32e4b9b6504fe8ea5c84c24c2cf4972c3307bd8ef9bb83ebbc93954e49144c5216fa08d3fd1b0f251bab463342de9908a38dd45d38e14b9f3758cbb59026
- SSDEEP 1536:rF6ngPOai2l1KX+MR/0jRsS/j3Gbx9f1CE:In6TPj38CE
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4016 msedge.exe 4016 msedge.exe 4952 msedge.exe 4952 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4952 msedge.exe 4952 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4952 wrote to memory of 3320 4952 msedge.exe 81 PID 4952 wrote to memory of 3320 4952 msedge.exe 81 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4704 4952 msedge.exe 82 PID 4952 wrote to memory of 4016 4952 msedge.exe 83 PID 4952 wrote to memory of 4016 4952 msedge.exe 83 PID 4952 wrote to memory of 2036 4952 msedge.exe 84 PID 4952 wrote to memory of 2036 4952 msedge.exe 84 PID 4952 wrote to memory of 2036 4952 msedge.exe 84 PID 4952 wrote to memory of 2036 4952 msedge.exe 84 PID 4952 wrote to memory of 2036 4952 msedge.exe 84 PID 4952 wrote to memory of 2036 4952 msedge.exe 84 PID 4952 wrote to memory of 2036 4952 msedge.exe 84 PID 4952 wrote to memory of 2036 4952 msedge.exe 84 PID 4952 wrote to memory of 2036 4952 msedge.exe 84 PID 4952 wrote to memory of 2036 4952 msedge.exe 84 PID 4952 wrote to memory of 2036 4952 msedge.exe 84 PID 4952 wrote to memory of 2036 4952 msedge.exe 84 PID 4952 wrote to memory of 2036 4952 msedge.exe 84 PID 4952 wrote to memory of 2036 4952 msedge.exe 84 PID 4952 wrote to memory of 2036 4952 msedge.exe 84 PID 4952 wrote to memory of 2036 4952 msedge.exe 84 PID 4952 wrote to memory of 2036 4952 msedge.exe 84 PID 4952 wrote to memory of 2036 4952 msedge.exe 84 PID 4952 wrote to memory of 2036 4952 msedge.exe 84 PID 4952 wrote to memory of 2036 4952 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a5124275c17b6ea2c8064b4f2b92cf8d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd08d146f8,0x7ffd08d14708,0x7ffd08d147182⤵PID:3320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,879576560161709277,1184577127461351249,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:4704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,879576560161709277,1184577127461351249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,879576560161709277,1184577127461351249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:82⤵PID:2036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,879576560161709277,1184577127461351249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:1880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,879576560161709277,1184577127461351249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,879576560161709277,1184577127461351249,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4308 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1920
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5012
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
- MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
- SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
- SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
- MD5 87f7abeb82600e1e640b843ad50fe0a1
- SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
- SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 3f5559bc8e43fe85f6b8b610f5825ce53211696f8a49374b4491994ce782d316
- MD5 7aa81bbe4833ea5c0cf9432d35c82ba6
- SHA1 a9cc8f54d5bcf3b430f63834bcac585a31e52f21
- SHA512 28ea53556afd8192b55555891432e06697cbe1c5bd0c59aa6ee91ee7cc208835959d0f2eb37812362035f47b3e9077df0595674eed79afa2750ac12f237317d3
- SSDEEP 96:nwk041jv0wpvWMoiVmdeH/zr/UWQyV+VDCziEwb:nwkR98GWMXvro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 91a2f91373b34dc5698aa7b036277ee1ea27f0c6e8084e1099be4f67aafacbeb
- MD5 55a56338898a8e50e900754dadb0b19b
- SHA1 5268d9e6e37fc5b91c7022377963dd45012589bc
- SHA512 af0e8110096cdad2be91d28f40108b8fe96638dd36d9f53f42a8fa767636ca02f747774853b82d2a61e0c01c983c49118718966b049e4e849f069f5a06b4fb42
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupxvce2RUA/myc:A9iIxuERzA83h09RZxY1CtVc
- MD5 SHA1 SHA512 SSDEEP