Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 15:01
Static task
static1
Behavioral task
behavioral1
Sample
a6280175d6e131cafe953478083020e0_JaffaCakes118.html
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a6280175d6e131cafe953478083020e0_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a6280175d6e131cafe953478083020e0_JaffaCakes118.html
- Size 58KB
- Sample240613-sd3ecaxgpl
- SHA256 5606108fc4854280ab1a2b328884b55b630d21023580403978e3a277a2f58734
- MD5 a6280175d6e131cafe953478083020e0
- SHA1 5be1d0932d807e38c371bd34ad67d16b9dd3ae17
- SHA512 219f97609fa845b796d93c6a38760c81bd1d9eba7673fdd9403d90101d2440557c97244641084752832ec76ab6e5d1609846f3d1340719f0b8a8b1e4a215cad8
- SSDEEP 1536:UPHv7ogZvEaR0eqGtX8fQukxmEwPF6D50:UPHTDR0zG2Qp0F6DS
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 464 msedge.exe 464 msedge.exe 112 msedge.exe 112 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe 2720 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 112 msedge.exe 112 msedge.exe 112 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe 112 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 112 wrote to memory of 116 112 msedge.exe 82 PID 112 wrote to memory of 116 112 msedge.exe 82 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 3428 112 msedge.exe 83 PID 112 wrote to memory of 464 112 msedge.exe 84 PID 112 wrote to memory of 464 112 msedge.exe 84 PID 112 wrote to memory of 1944 112 msedge.exe 85 PID 112 wrote to memory of 1944 112 msedge.exe 85 PID 112 wrote to memory of 1944 112 msedge.exe 85 PID 112 wrote to memory of 1944 112 msedge.exe 85 PID 112 wrote to memory of 1944 112 msedge.exe 85 PID 112 wrote to memory of 1944 112 msedge.exe 85 PID 112 wrote to memory of 1944 112 msedge.exe 85 PID 112 wrote to memory of 1944 112 msedge.exe 85 PID 112 wrote to memory of 1944 112 msedge.exe 85 PID 112 wrote to memory of 1944 112 msedge.exe 85 PID 112 wrote to memory of 1944 112 msedge.exe 85 PID 112 wrote to memory of 1944 112 msedge.exe 85 PID 112 wrote to memory of 1944 112 msedge.exe 85 PID 112 wrote to memory of 1944 112 msedge.exe 85 PID 112 wrote to memory of 1944 112 msedge.exe 85 PID 112 wrote to memory of 1944 112 msedge.exe 85 PID 112 wrote to memory of 1944 112 msedge.exe 85 PID 112 wrote to memory of 1944 112 msedge.exe 85 PID 112 wrote to memory of 1944 112 msedge.exe 85 PID 112 wrote to memory of 1944 112 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a6280175d6e131cafe953478083020e0_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa06e046f8,0x7ffa06e04708,0x7ffa06e047182⤵PID:116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7664231129498392720,3055628257290079438,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:3428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7664231129498392720,3055628257290079438,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7664231129498392720,3055628257290079438,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:82⤵PID:1944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7664231129498392720,3055628257290079438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:12⤵PID:2804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7664231129498392720,3055628257290079438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:12⤵PID:5100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7664231129498392720,3055628257290079438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:12⤵PID:5116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7664231129498392720,3055628257290079438,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4676 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2720
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2876
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
- MD5 c5abc082d9d9307e797b7e89a2f755f4
- SHA1 54c442690a8727f1d3453b6452198d3ec4ec13df
- SHA512 ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
- MD5 b4a74bc775caf3de7fc9cde3c30ce482
- SHA1 c6ed3161390e5493f71182a6cb98d51c9063775d
- SHA512 55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 144B
- SHA256 f40abf95f64399854cda58b500aec57c22a24cbba1b4342c8781932cead5aa0c
- MD5 a692396ddfcd1d23305babbd6e02528b
- SHA1 b142a25984acb06eddd294f79090574605127789
- SHA512 9b0d42babf7dc1bf3773d48f00a43fcfd01a9d08c1de98808e2584fb199912f641e63ab727a8ffc4ebbe6f07d1dac446bd0b0ef957ccaafc2cd4d2a8934bca3e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 1KB
- SHA256 7150b6c4d559df13c22fae761b1f21c22a07da3ec7eef4ff86a65f237c5d2661
- MD5 5e96f7ecd0b52abed1ffc6c621050b1b
- SHA1 cc368461ffa08b0bf5d202322198cbf8bb9a5584
- SHA512 d94a4d8c17d57af038d6b13fe8828fc2eb434180c5490f444496b55ab732d9f09eaab746720f1ff4aad31bfb6fdfe61391bc4917ad86b60a276e6f83a2c84984
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 072dffd245fd4d0abbb2f6dab1aafcb62a184d11005a05a7067365336a230090
- MD5 ce0e5348fef108d66fd0c6f39f2eb9f8
- SHA1 19511ebd15da2e880128f1067b9513cc12611849
- SHA512 a9fe30140c232689db465ebafda0ecc37b2ca61959fb0297e3605cb2e3b7c565a3059b293a05dd357edb37f01669f1092339aa38e2a586f32c0aaffe62c0941c
- SSDEEP 96:ngk/oxm/DQYmqq1aJEeEcwpvWMoiVmdeHnaCUWQyV+VDCziEwb:ngkBIdgJEebGWMXZro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 fc17c24f9fe17b2ec99a343542528a95b9350b8efef185abcdeb15eff1fa984d
- MD5 a903127b9eb68ecc290ec77edb2e6469
- SHA1 5e4e83abdd446936da4181a4e241925f2272c000
- SHA512 9d900ff5b81888c61bad004672a10385908a5ed15c17ef97a5bd1a6b4ab68d6e7fe17432b572e3782135e5f7446fade7dc114fc6d30120e5fd537db8d25f8666
- SSDEEP 96:ngk/oxm/Dnmqq1aJEeEcwpvWMoiVmdeoh78G0qnaCUWQyV+VDCAiEwb:ngkB6dgJEebGWM4h7eqZrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
- Size 537B
- SHA256 39e93c5c876010cbb4fc7b1a733c103164f6d9c6935c8379f6c059d122323da3
- MD5 259a22890b3ef6beaf3db7fc86e18965
- SHA1 d4e8084011b882563eb69b170303de1dab009939
- SHA512 c760acc79c441b0423e41e5509254c2c9397e793185ed66f60b310113f849da2dba707e4990bc6dac6dc239e0feeca531e56fae39579b82d8002c3e2c4acd7fe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cfc3.TMP
- Size 370B
- SHA256 d5bca32429b29d0eafface4b898fbafbb206139fb517ff4f0bd68f666f55d21f
- MD5 5ec6de548abcfa93910e61b7cd94bb97
- SHA1 46552d0c6c66f788bf960b8ffcf51183c775539f
- SHA512 ec996e20342df28fe253f0ce9b82ccfdefa654a709c3ea73215ccb941718a83d2d3d4858c6254ec420f8c2d8510844966f833a1d9d84e042cb591bbccc89ae74
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 335f83760c7c68c750788c43cfa7609e1d90cffc893389fedf3d3ce0a34104a1
- MD5 653e0a6244f240b0393f5e7727fc8681
- SHA1 f881e96393bc16868ebc76af6c5ff31b4e002d03
- SHA512 afd2f15f84e9dec4bfdb3158f8326ea58f0081643382a7e6e4ddd5467203b7bdc72bd9c75d548cdc43307bc416f51cc31eb01cf2c39709451afc566f5941e9d7
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupiSRe2RUZ9t/3z2OMDCRHqt:A9iIxuERzA83h09RZxY3FI/aOMWRHqlD
- MD5 SHA1 SHA512 SSDEEP