Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 10:43
Static task
static1
Behavioral task
behavioral1
Sample
a522a008972aa15b1d5cd65713a5ee6f_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a522a008972aa15b1d5cd65713a5ee6f_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a522a008972aa15b1d5cd65713a5ee6f_JaffaCakes118.html
- Size 13KB
- Sample240613-msa1ravgla
- SHA256 0632a843a7045da61efe7185badedb51e49c95864b0e7c0b1f6581aa91fb75df
- MD5 a522a008972aa15b1d5cd65713a5ee6f
- SHA1 2c7ff763e43b5d5f6101ec0ddc9b2c840e4a5fe2
- SHA512 a6bdc93fbdbc4e84f161cbbf12e05fd965ddc097307d6ac9c9f84d0b93c2a607a6f4b86732cd2234e320efc845500b86045309035f3576587b2ad71d2a2d8fa1
- SSDEEP 384:lPIT0sV8Dp/G/u65Y/UuqG/StG0GYR2/BV5f6bOzE8uM:tIT0sV8Dp/G/P5Y/UuqGMG1YR2/BVnEe
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2100 msedge.exe 2100 msedge.exe 1564 msedge.exe 1564 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1564 msedge.exe 1564 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1564 wrote to memory of 2164 1564 msedge.exe 82 PID 1564 wrote to memory of 2164 1564 msedge.exe 82 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 1740 1564 msedge.exe 84 PID 1564 wrote to memory of 2100 1564 msedge.exe 85 PID 1564 wrote to memory of 2100 1564 msedge.exe 85 PID 1564 wrote to memory of 2420 1564 msedge.exe 86 PID 1564 wrote to memory of 2420 1564 msedge.exe 86 PID 1564 wrote to memory of 2420 1564 msedge.exe 86 PID 1564 wrote to memory of 2420 1564 msedge.exe 86 PID 1564 wrote to memory of 2420 1564 msedge.exe 86 PID 1564 wrote to memory of 2420 1564 msedge.exe 86 PID 1564 wrote to memory of 2420 1564 msedge.exe 86 PID 1564 wrote to memory of 2420 1564 msedge.exe 86 PID 1564 wrote to memory of 2420 1564 msedge.exe 86 PID 1564 wrote to memory of 2420 1564 msedge.exe 86 PID 1564 wrote to memory of 2420 1564 msedge.exe 86 PID 1564 wrote to memory of 2420 1564 msedge.exe 86 PID 1564 wrote to memory of 2420 1564 msedge.exe 86 PID 1564 wrote to memory of 2420 1564 msedge.exe 86 PID 1564 wrote to memory of 2420 1564 msedge.exe 86 PID 1564 wrote to memory of 2420 1564 msedge.exe 86 PID 1564 wrote to memory of 2420 1564 msedge.exe 86 PID 1564 wrote to memory of 2420 1564 msedge.exe 86 PID 1564 wrote to memory of 2420 1564 msedge.exe 86 PID 1564 wrote to memory of 2420 1564 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a522a008972aa15b1d5cd65713a5ee6f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9095c46f8,0x7ff9095c4708,0x7ff9095c47182⤵PID:2164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,1670053454209674409,2236927085046377833,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:22⤵PID:1740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,1670053454209674409,2236927085046377833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,1670053454209674409,2236927085046377833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:2420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1670053454209674409,2236927085046377833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:4768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1670053454209674409,2236927085046377833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,1670053454209674409,2236927085046377833,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4992
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4660
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e
- MD5 db9081c34e133c32d02f593df88f047a
- SHA1 a0da007c14fd0591091924edc44bee90456700c6
- SHA512 12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f
- MD5 3a09f853479af373691d131247040276
- SHA1 1b6f098e04da87e9cf2d3284943ec2144f36ac04
- SHA512 341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 ab6f4464d48f3058525d27608c18f3d73c188f0f7057fdda5e30c5f614a212eb
- MD5 bfbaa372bee543e8d5bdf2b460ab368b
- SHA1 37efb681bbe13e631a073d3897158c587f4da98b
- SHA512 1851261221521f7717e40a6e8d5e55984d2079da09f2cd3fff225db0fd2fc1f305588cb85c1326014cac2366a2fe717e9c21b5653c8d6c8371d2f2ad4506da4c
- SSDEEP 96:nKk/oxm/DQYmqa1uK/wpvWMoiVmdeHgi5YUWQyV+VDCziEwb:nKkBIB0EGWMX5Yro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 74453e10562b44249b42ca877d80904573534366573b046b0e0d882c25d4ce0b
- MD5 17cb6611aa18938cda828f6ef781656e
- SHA1 c03e8e210393a809ff66dda73eee600754f231da
- SHA512 34f2f79763e8241ad8dfdca8eaadacf79e882c31f025ec28aaf25ec79f9dc86773d8cfece8456ca67ed4d1691a1ce26312e2e967b8d4e1c39f3de8d45ae61005
- SSDEEP 96:nKk/oxm/Dnmqa1uS/wpvWMoiVmdeOVxY2gm5YUWQyV+VDCAiEwb:nKkB6B0cGWMefY2DYrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bed2e84b-2a00-4f92-b261-df09e4e7eb6d.tmp
- Size 6KB
- SHA256 635d3ef542e561a34c05050a53d019cb70106ca99a1344cf05b19c717169e2d6
- MD5 cba1ca31118e0027661679ad0496dd0d
- SHA1 3cb16374856f59e4308719f6474105991b9e189c
- SHA512 9d9ded4daadee29e9ce9837301752b39eec25af033e8e2f8a4aef490603e6cd1a4d7fa32f6b3cdb18230d4717f73b25d3bd50e46c97ee8f8a09c9238959e81ac
- SSDEEP 96:nKk/oxm/Dnmqa1uK/wpvWMoiVmde92gi5YUWQyV+VDCAiEwb:nKkB6B0EGWMN25YrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 7a89ce0116add2f07904ec0461ce70fc5158b294ba86835b240ae1870e412a56
- MD5 be3f1c0c8e0ef89a553acda9cc253d6e
- SHA1 39e54f694676fbd0f21817c9b41841b115a492b0
- SHA512 6499646e84e2585ae5f5d24f82ff6416d55cf20b7dff7c8fecfd3f30cdb51182834399c0696060056b5426391e793d9bd90faa2407e4a18fc04806b4e66d11a7
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZNe2RUe2kx3z2OMDCRHqlY:A9iIxuERzA83h09RZxYZJfxaOMWRHqlY
- MD5 SHA1 SHA512 SSDEEP