Analysis
- max time kernel
145s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
22/07/2024, 16:18
Static task
static1
Behavioral task
behavioral1
Sample
63e407e33e914480e3bedcacb2a92f1d_JaffaCakes118.html
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
63e407e33e914480e3bedcacb2a92f1d_JaffaCakes118.html
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 63e407e33e914480e3bedcacb2a92f1d_JaffaCakes118.html
- Size 149KB
- Sample240722-tr8c7awdnb
- SHA256 73f6779093b153b3681cd2d2fa01ba6287dc12e7109666ed7da385bb69531294
- MD5 63e407e33e914480e3bedcacb2a92f1d
- SHA1 0f51a62bcb78caaac780f81cf7f8d8ebea6be367
- SHA512 7d9bc6bb0ddc68d27c5a5c3f4337696fea0f738188a9ec048ffb6a22c2611347e5eae2d1ed0e78bd628b98bd6dbe968424bbcf28d80e874f81597169e6d7afd7
- SSDEEP 1536:pbMjw2fMk1D3O9Pj2fcDjuHAAOLL3JpWcZQ7Lr1p:sV98LCd
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4088 msedge.exe 4088 msedge.exe 4836 msedge.exe 4836 msedge.exe 1060 msedge.exe 1060 msedge.exe 1060 msedge.exe 1060 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4836 msedge.exe 4836 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4836 wrote to memory of 3028 4836 msedge.exe 84 PID 4836 wrote to memory of 3028 4836 msedge.exe 84 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 4088 4836 msedge.exe 86 PID 4836 wrote to memory of 4088 4836 msedge.exe 86 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63e407e33e914480e3bedcacb2a92f1d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff952d746f8,0x7ff952d74708,0x7ff952d747182⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17398065685344970884,2461641180053240000,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:1480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,17398065685344970884,2461641180053240000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,17398065685344970884,2461641180053240000,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:82⤵PID:2216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17398065685344970884,2461641180053240000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:3708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17398065685344970884,2461641180053240000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:12⤵PID:3680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17398065685344970884,2461641180053240000,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2896 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1060
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3052
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307
- MD5 584971c8ba88c824fd51a05dddb45a98
- SHA1 b7c9489b4427652a9cdd754d1c1b6ac4034be421
- SHA512 5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37
- MD5 b28ef7d9f6d74f055cc49876767c886c
- SHA1 d6b3267f36c340979f8fc3e012fdd02c468740bf
- SHA512 491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 c6f9844f20796fa61fe6684f4e8141fffc31e1c5c9566323e61cedd969402438
- MD5 a1441bdb391c4c932943fba0edb35fe1
- SHA1 9c5ec033046776bd04c65d511e0427497d571f0b
- SHA512 73c703cdceed55f8c77d8776de26b4f4863741e9bfcfae0594a4b03806f47f8a8745af96e5d6c7965256a6da6b2addd375c4b492dbc5c73e102df2d2628ee03c
- SSDEEP 96:nEjkVU/1wNqwpvWMoiVmdeH1JjbBxrUWQyV+VDCziEwb:nokquNqGWMX9tro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 4ec59b5136e1837808115d994f42b3b1e866c72546283ccb64492aad2bccf564
- MD5 e67fe1efd0002f7513560e21458ad8a7
- SHA1 166b6c96bc0af04ad86b5ab58e0e23e9d50a66a2
- SHA512 52c99fff66c7d9313e0d9bfa349ef48ec46bb9236dbdbddde646d1e869ff34a3045d2eba1145819a2ab97d6a46301f28ee0b9597ff25ea69f0b9aa63fa0e6e81
- SSDEEP 96:nEjkQU/1wNqwpvWMoiVmdeH1JjbBxrUWQyV+VDCAiEwb:nok1uNqGWMX9trV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 2d0b47abd03610eb56d79c93f0fa0206b5fc1672071392e43a8814b893fcfb0d
- MD5 220b5db46f8273f0325fd5a6113b07e8
- SHA1 79c7d5ec6f5a1953bc0c6f5bc7f7ddb9d046874e
- SHA512 cd1efd96e183efd6ca61a7c7aebd0c0065772d9a7c3ce495aef529fa316f9af3470962033130efac2c84b6405996d20514b2c12fd9c0d44ad991e1db81508407
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup9XWZe2RUVpeN/sRci9gpC2:A9iIxuERzA83h09RZxYyDN/OcNpCkA8z
- MD5 SHA1 SHA512 SSDEEP