Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 00:27
Static task
static1
Behavioral task
behavioral1
Sample
a74f6567689e330a5f2a667dfdf19f82_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a74f6567689e330a5f2a667dfdf19f82_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a74f6567689e330a5f2a667dfdf19f82_JaffaCakes118.html
- Size 18KB
- Sample240614-aryzza1emm
- SHA256 db6de6bfa72ccfe032d8c79e39fd0797be62af38c996a57cee3ac5fd5c3e7c3e
- MD5 a74f6567689e330a5f2a667dfdf19f82
- SHA1 95beb1edb34be9e60d122f10a4a99b3c312adf8a
- SHA512 d941fe6461e97af4ff662e37ac2a139d0f43977768ce81aab16f80dd095edfc1a6d8dadc0adf7d4cd538dbc27ec82d9414e84a96031ebff4aa288e0f51502f2c
- SSDEEP 192:SIM3t0I5fo9cKivXQWxZxdkVSoAIy4ozUnjBhUe82qDB8:SIMd0I5nvHbsvUNxDB8
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1916 msedge.exe 1916 msedge.exe 3000 msedge.exe 3000 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3000 msedge.exe 3000 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 660 3000 msedge.exe 81 PID 3000 wrote to memory of 660 3000 msedge.exe 81 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 2708 3000 msedge.exe 82 PID 3000 wrote to memory of 1916 3000 msedge.exe 83 PID 3000 wrote to memory of 1916 3000 msedge.exe 83 PID 3000 wrote to memory of 3460 3000 msedge.exe 84 PID 3000 wrote to memory of 3460 3000 msedge.exe 84 PID 3000 wrote to memory of 3460 3000 msedge.exe 84 PID 3000 wrote to memory of 3460 3000 msedge.exe 84 PID 3000 wrote to memory of 3460 3000 msedge.exe 84 PID 3000 wrote to memory of 3460 3000 msedge.exe 84 PID 3000 wrote to memory of 3460 3000 msedge.exe 84 PID 3000 wrote to memory of 3460 3000 msedge.exe 84 PID 3000 wrote to memory of 3460 3000 msedge.exe 84 PID 3000 wrote to memory of 3460 3000 msedge.exe 84 PID 3000 wrote to memory of 3460 3000 msedge.exe 84 PID 3000 wrote to memory of 3460 3000 msedge.exe 84 PID 3000 wrote to memory of 3460 3000 msedge.exe 84 PID 3000 wrote to memory of 3460 3000 msedge.exe 84 PID 3000 wrote to memory of 3460 3000 msedge.exe 84 PID 3000 wrote to memory of 3460 3000 msedge.exe 84 PID 3000 wrote to memory of 3460 3000 msedge.exe 84 PID 3000 wrote to memory of 3460 3000 msedge.exe 84 PID 3000 wrote to memory of 3460 3000 msedge.exe 84 PID 3000 wrote to memory of 3460 3000 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a74f6567689e330a5f2a667dfdf19f82_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffb7be46f8,0x7fffb7be4708,0x7fffb7be47182⤵PID:660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,8287747640301419164,4932282693207706264,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:22⤵PID:2708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,8287747640301419164,4932282693207706264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,8287747640301419164,4932282693207706264,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2456 /prefetch:82⤵PID:3460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,8287747640301419164,4932282693207706264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:3956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,8287747640301419164,4932282693207706264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:3780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,8287747640301419164,4932282693207706264,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3932
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4612
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
- MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
- SHA1 86174e670c44767c08a39cc2a53c09c318326201
- SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
- MD5 b704c9ca0493bd4548ac9c69dc4a4f27
- SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
- SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 95d7a51a71b1355d36c001da7e61a5e83f1d8b514ec7be7d892470e1a2210aeb
- MD5 f510805a986fc3ba57550ece3abc373e
- SHA1 82d41955077d463872e350d5a12cb8c49a12a48b
- SHA512 c1b0c76662267228adfcf9c2dd489be1e5ce156adc3e0f56f36f7f01059af98a1ad697e9aa5384ced53ea60e1aca7797b014fe881beb59b221a57ab4d2484778
- SSDEEP 96:nuk/oxm/DQYmqp1UvwpvWMoiVmdeH2WfGrUWQyV+VDCziEwb:nukBIqCvGWMXWrro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 05feab3d9c7381148075c264a0655e38379a6ec4c98e6b8e7ad646be62e7c084
- MD5 305c878434d0899c70915236107e315b
- SHA1 9e4a82002b09b0572e9c404396df1154bdf91c1c
- SHA512 b3c764e8648289bd14e522c3aba12d6abfbb5e760ddf277b74db9135a7018558d9e5e3d8495db99c39f7c71a6e262602d0f2a7b21a2b7596447c91818d685800
- SSDEEP 96:nuk/oxm/Dnmqp1UvwpvWMoiVmdeH2WfGrUWQyV+VDCAiEwb:nukB6qCvGWMXWrrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 cd324c4ec5cb8eb0f165774615b4af65c92b6642f721e9887e920064d8593caf
- MD5 a2cc6198e4f4c6f763868127bad83986
- SHA1 66f12b8092489d4a60013f8242fcb241ed6bd533
- SHA512 2cde88ea126f71444eaf58930e1e6b9b02c1415d200f7c98d37f5f607c2a1f831a098c100cebf32ae6c5d23a53a73219fe04ea0857cfa066ab543fca81a48211
- SSDEEP 96:nuk/oxm/Dnmqp1UKwpvWMoiVmdeH2WfGrUWQyV+VDCAiEwb:nukB6qCKGWMXWrrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 54303e9e2a086f7e59e45638429cc04888e30367b880e0500c2542252116d3f3
- MD5 3a273a56b07d5b6fe5ba36cb2492050a
- SHA1 ee4c95cd80af0bb2364d530e7020ff41e14d0f02
- SHA512 2c14ffd70eaa7f660410e912df65f976cd10fdba802208011e2a286f1027cb51a9395506168ebf82acdef7107b1cbcf5d881e76013c11efe2db5ffe4db6f3ad7
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup1Hf0e2RUwh/j3z2OMDCRHy:A9iIxuERzA83h09RZxYZyPjaOMWRHqlP
- MD5 SHA1 SHA512 SSDEEP