Analysis
- max time kernel
145s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 12:37
Static task
static1
Behavioral task
behavioral1
Sample
a59340e096c1426f16e6531b6bd235a9_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
a59340e096c1426f16e6531b6bd235a9_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a59340e096c1426f16e6531b6bd235a9_JaffaCakes118.html
- Size 24KB
- Sample240613-ptwd7ayfre
- SHA256 4f2953739fed415834994f6da890c00e05b2e0b4edd5bee6ea0fb160a0cb9413
- MD5 a59340e096c1426f16e6531b6bd235a9
- SHA1 8a1c8d1beacfd7b80355fd25eb26e3789e9122ef
- SHA512 c717e091cec983cbc6e4a88d14b5ec896d1b69e59a9d8e60306cadb65fbc9eab24c73d9985c619caf2fb838e7b6b6e028f04fc676a786cb2ca281b419c5d795d
- SSDEEP 192:WLZLwKQRUO4k/h1oTUdQ/uQe/4Ui+Bl0iB+0xPi6bW1ThIw5WafW8OhT0Z9LRRK1:fmU2/ILE1TuUZtcFH
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2232 msedge.exe 2232 msedge.exe 3880 msedge.exe 3880 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3880 msedge.exe 3880 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3880 wrote to memory of 3724 3880 msedge.exe 82 PID 3880 wrote to memory of 3724 3880 msedge.exe 82 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2924 3880 msedge.exe 83 PID 3880 wrote to memory of 2232 3880 msedge.exe 84 PID 3880 wrote to memory of 2232 3880 msedge.exe 84 PID 3880 wrote to memory of 2108 3880 msedge.exe 85 PID 3880 wrote to memory of 2108 3880 msedge.exe 85 PID 3880 wrote to memory of 2108 3880 msedge.exe 85 PID 3880 wrote to memory of 2108 3880 msedge.exe 85 PID 3880 wrote to memory of 2108 3880 msedge.exe 85 PID 3880 wrote to memory of 2108 3880 msedge.exe 85 PID 3880 wrote to memory of 2108 3880 msedge.exe 85 PID 3880 wrote to memory of 2108 3880 msedge.exe 85 PID 3880 wrote to memory of 2108 3880 msedge.exe 85 PID 3880 wrote to memory of 2108 3880 msedge.exe 85 PID 3880 wrote to memory of 2108 3880 msedge.exe 85 PID 3880 wrote to memory of 2108 3880 msedge.exe 85 PID 3880 wrote to memory of 2108 3880 msedge.exe 85 PID 3880 wrote to memory of 2108 3880 msedge.exe 85 PID 3880 wrote to memory of 2108 3880 msedge.exe 85 PID 3880 wrote to memory of 2108 3880 msedge.exe 85 PID 3880 wrote to memory of 2108 3880 msedge.exe 85 PID 3880 wrote to memory of 2108 3880 msedge.exe 85 PID 3880 wrote to memory of 2108 3880 msedge.exe 85 PID 3880 wrote to memory of 2108 3880 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a59340e096c1426f16e6531b6bd235a9_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeedaa46f8,0x7ffeedaa4708,0x7ffeedaa47182⤵PID:3724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,15524010735626299559,18300883872093247496,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:22⤵PID:2924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,15524010735626299559,18300883872093247496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,15524010735626299559,18300883872093247496,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:82⤵PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,15524010735626299559,18300883872093247496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:3588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,15524010735626299559,18300883872093247496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,15524010735626299559,18300883872093247496,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1216
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4288
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
- MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
- SHA1 86174e670c44767c08a39cc2a53c09c318326201
- SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
- MD5 b704c9ca0493bd4548ac9c69dc4a4f27
- SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
- SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 0d4d6598ab7680fbedfac9585a0ad2a8bf2db4d931fa436685bb40f85e985dea
- MD5 868438e6ed59abd06456ca2bda5c0ffa
- SHA1 1dfb47b67fed04ef7c8e834cd61ba9086e1ab13b
- SHA512 f529bcd17d269d25cd549a55d6b0d50fabc8b187912132369876918671a2ef414e008dc845e167424a8e74c0f5ab854148825163c3e109052ae9185750959cf9
- SSDEEP 96:nw9k/oxm/DQYmqAy1ETvwpvWMoiVmdeH2WfVPkjUWQyV+VDCziEwb:nw9kBIByaTvGWMXFsjro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 e18a37ad7f2e80ae0b03ac5d142f39920efe44a2ce5ad36669dfb8e6f14c18d1
- MD5 5e35d2a7650df0380202ec525aed2188
- SHA1 c01660b04022757dcb106bf27a623a8d0605c2dc
- SHA512 b0e2066045ca1ecfa626fa9006840f5662e5829de654a4e569e7794b7932d78955284de8316dfd21f9b3c66caf348e46c770f750cbdbdd6411de3fd337a81161
- SSDEEP 96:nw9k/oxm/DnmqAy1ETvwpvWMoiVmdeH2WfVPkjUWQyV+VDCAiEwb:nw9kB6ByaTvGWMXFsjrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 c6de90c5b0910d23067944bfc54bbc2ef15260a04ee769edce78ec864d473db0
- MD5 9f62c12798a4b5b70c0e54af47e6d308
- SHA1 68ba7f3b7d76f16b8854f690c7d3c3bd7551c2e0
- SHA512 9ebcef2503f79c005b13c3e40334a101f0916d0231b368a4ada22a117e2c2869d73f46579c8df6d68bb6144f03d93400c66e25f4adb804bcf33f8e4d62966c4c
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupWHfc3e2RUmjzh/Re3z2OM1:A9iIxuERzA83h09RZxYME/jjJReaOMWM
- MD5 SHA1 SHA512 SSDEEP