Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 14:05
Static task
static1
Behavioral task
behavioral1
Sample
a5ef7bc114f8e9960d216321e0660e8d_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a5ef7bc114f8e9960d216321e0660e8d_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a5ef7bc114f8e9960d216321e0660e8d_JaffaCakes118.html
- Size 19KB
- Sample240613-rd1ebawdrn
- SHA256 4cd9e0e4f476e2d3339af65ac461ed6c7b5b8d02fbf68ae11cd5768d3738dd2b
- MD5 a5ef7bc114f8e9960d216321e0660e8d
- SHA1 7456661d097be051d5799fb7aefa117359d9a08f
- SHA512 a6bc4122e507b7f88e63da5789d772ee1e0a39caea435173c1b22552d18e5e842e64eed82c7842faf18fd767edfec130a0f7381fd79128ea8ecd42da23c9d61f
- SSDEEP 192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIj4vzUnjBhJT82qDB8:SIMd0I5nO9HhsvJIxDB8
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 508 msedge.exe 508 msedge.exe 4164 msedge.exe 4164 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4164 msedge.exe 4164 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4164 wrote to memory of 3744 4164 msedge.exe 81 PID 4164 wrote to memory of 3744 4164 msedge.exe 81 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 1228 4164 msedge.exe 82 PID 4164 wrote to memory of 508 4164 msedge.exe 83 PID 4164 wrote to memory of 508 4164 msedge.exe 83 PID 4164 wrote to memory of 2384 4164 msedge.exe 84 PID 4164 wrote to memory of 2384 4164 msedge.exe 84 PID 4164 wrote to memory of 2384 4164 msedge.exe 84 PID 4164 wrote to memory of 2384 4164 msedge.exe 84 PID 4164 wrote to memory of 2384 4164 msedge.exe 84 PID 4164 wrote to memory of 2384 4164 msedge.exe 84 PID 4164 wrote to memory of 2384 4164 msedge.exe 84 PID 4164 wrote to memory of 2384 4164 msedge.exe 84 PID 4164 wrote to memory of 2384 4164 msedge.exe 84 PID 4164 wrote to memory of 2384 4164 msedge.exe 84 PID 4164 wrote to memory of 2384 4164 msedge.exe 84 PID 4164 wrote to memory of 2384 4164 msedge.exe 84 PID 4164 wrote to memory of 2384 4164 msedge.exe 84 PID 4164 wrote to memory of 2384 4164 msedge.exe 84 PID 4164 wrote to memory of 2384 4164 msedge.exe 84 PID 4164 wrote to memory of 2384 4164 msedge.exe 84 PID 4164 wrote to memory of 2384 4164 msedge.exe 84 PID 4164 wrote to memory of 2384 4164 msedge.exe 84 PID 4164 wrote to memory of 2384 4164 msedge.exe 84 PID 4164 wrote to memory of 2384 4164 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a5ef7bc114f8e9960d216321e0660e8d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef34646f8,0x7ffef3464708,0x7ffef34647182⤵PID:3744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13266547304431107772,17890512034664787873,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵PID:1228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,13266547304431107772,17890512034664787873,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,13266547304431107772,17890512034664787873,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵PID:2384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13266547304431107772,17890512034664787873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:3568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13266547304431107772,17890512034664787873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:1696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13266547304431107772,17890512034664787873,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3048 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4628
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4636
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
- MD5 dabfafd78687947a9de64dd5b776d25f
- SHA1 16084c74980dbad713f9d332091985808b436dea
- SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
- MD5 c39b3aa574c0c938c80eb263bb450311
- SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
- SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 1f5f1687d41ffa11e1ebf2cd1f715335c87e05684f51d7b2e745db11785ff6bb
- MD5 e220e4c9435cf2c1e1d22e4ee01ab2e5
- SHA1 bb338ca47477ba81a2ac2d6a83acd906651513f7
- SHA512 1356a6f56b401478eb6b44ae79b3bab59b2f512f3f66e3448f2d41943fe09905612d973a0320542e98b850bf508f008cb32ebd0ca634f501e08de60a1493f7ee
- SSDEEP 96:nq4kloxm/DQYmq611kemwpvWMoiVmdeH1DzsAUWQyV+VDCziEwb:nq4kPIl1eemGWMXCAro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 ab077c87babbc736fb51d7acf07556cbd30f7af380ac46a8098956754103cf24
- MD5 3253941b22aa905a630e08320cf73c80
- SHA1 d52158a540ea8b53b7546ab40fc8756e9261bd1c
- SHA512 96d33081fc0796e4ec6916af63639a780143007e85167ee6e48b7d9f7e7d5e6d3e7975a66f4c59ee49b0fc33095a2a2bc8d1d8d5262b05a5a33dfd84ff6ed2f8
- SSDEEP 96:nq4kloxm/Dnmq611kfmwpvWMoiVmdeH1DzsAUWQyV+VDCAiEwb:nq4kP6l1efmGWMXCArV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 fdb7e31a87ff67e468dccc718e273f9d0524133b14cb887a46c7b224c88350c2
- MD5 637aad074ffc282e90df129929b343d7
- SHA1 8365f951cd14fd8bb62277df59dfe66e5ec449a9
- SHA512 0e27f668e7f669e6746f8c7d307c5cc2ca5ecce80b4eebf5a3b77c4b95e7c5a463716677e67af4120931e2a32dcef8e951ae2b8b5f4d42f30cc717ccd68c2749
- SSDEEP 96:nq4kloxm/Dnmq611kemwpvWMoiVmdeH1DzsAUWQyV+VDCAiEwb:nq4kP6l1eemGWMXCArV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 347829eff4fe3b0b301c03f46019c263952765ce8f43519bd19e37cb369e74db
- MD5 63b9abfd2a0b1dcfc03c603545b798c1
- SHA1 1c5e916ab2fdc02fe14ee2b377e54d6ab9763077
- SHA512 519a69a3128f7f08dd4750f45947d3b102b988866d03ce93863ba792bebba08ad15c3ff0f03267eb527c437a30f04609937631bb6072ffd5abe6e0688063aec0
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupgze2RUu2SRsHM3z2OMDCRh:A9iIxuERzA83h09RZxYQHGHMaOMWRHqu
- MD5 SHA1 SHA512 SSDEEP