Analysis
- max time kernel
145s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
25/07/2024, 22:27
Static task
static1
Behavioral task
behavioral1
Sample
717dda858aab6d10a414cbf99ef5f424_JaffaCakes118.html
Resource
win7-20240705-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
717dda858aab6d10a414cbf99ef5f424_JaffaCakes118.html
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 717dda858aab6d10a414cbf99ef5f424_JaffaCakes118.html
- Size 199KB
- Sample240725-2dfd9a1hqd
- SHA256 f15302117210b0027365ae68be879669881d14c287e4e6eb1e5147a9f6b069e9
- MD5 717dda858aab6d10a414cbf99ef5f424
- SHA1 558b473dcd500745d5f4f3ab7861c017299d0bcb
- SHA512 6ca636a0c375b2c5bc1791e47654dc2fcc3281cd2779283e6c58402c76f52086c3e17139542140f32d73f166a64e06745251b57d9ac7a1c5c1755de3b8642185
- SSDEEP 3072:S2HFF+mJHHJwpJBkjquyfkMY+BES09JXAnyrZalI+Y8cTmiiiiiiyn2zv:S2/z5AsMYod+X3oI+YdTmiiiiiiy2v
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2652 msedge.exe 2652 msedge.exe 4360 msedge.exe 4360 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4360 wrote to memory of 2940 4360 msedge.exe 84 PID 4360 wrote to memory of 2940 4360 msedge.exe 84 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 3428 4360 msedge.exe 85 PID 4360 wrote to memory of 2652 4360 msedge.exe 86 PID 4360 wrote to memory of 2652 4360 msedge.exe 86 PID 4360 wrote to memory of 4372 4360 msedge.exe 87 PID 4360 wrote to memory of 4372 4360 msedge.exe 87 PID 4360 wrote to memory of 4372 4360 msedge.exe 87 PID 4360 wrote to memory of 4372 4360 msedge.exe 87 PID 4360 wrote to memory of 4372 4360 msedge.exe 87 PID 4360 wrote to memory of 4372 4360 msedge.exe 87 PID 4360 wrote to memory of 4372 4360 msedge.exe 87 PID 4360 wrote to memory of 4372 4360 msedge.exe 87 PID 4360 wrote to memory of 4372 4360 msedge.exe 87 PID 4360 wrote to memory of 4372 4360 msedge.exe 87 PID 4360 wrote to memory of 4372 4360 msedge.exe 87 PID 4360 wrote to memory of 4372 4360 msedge.exe 87 PID 4360 wrote to memory of 4372 4360 msedge.exe 87 PID 4360 wrote to memory of 4372 4360 msedge.exe 87 PID 4360 wrote to memory of 4372 4360 msedge.exe 87 PID 4360 wrote to memory of 4372 4360 msedge.exe 87 PID 4360 wrote to memory of 4372 4360 msedge.exe 87 PID 4360 wrote to memory of 4372 4360 msedge.exe 87 PID 4360 wrote to memory of 4372 4360 msedge.exe 87 PID 4360 wrote to memory of 4372 4360 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\717dda858aab6d10a414cbf99ef5f424_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbcf3246f8,0x7ffbcf324708,0x7ffbcf3247182⤵PID:2940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,13433606666242361940,2210989290566174502,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:22⤵PID:3428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,13433606666242361940,2210989290566174502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,13433606666242361940,2210989290566174502,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:82⤵PID:4372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13433606666242361940,2210989290566174502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2776 /prefetch:12⤵PID:3516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13433606666242361940,2210989290566174502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13433606666242361940,2210989290566174502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2132 /prefetch:12⤵PID:1372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13433606666242361940,2210989290566174502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:12⤵PID:3376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13433606666242361940,2210989290566174502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,13433606666242361940,2210989290566174502,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3764
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:224
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 1191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e
- MD5 2f842025e22e522658c640cfc7edc529
- SHA1 4c2b24b02709acdd159f1b9bbeb396e52af27033
- SHA512 6e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 1971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e
- MD5 54aadd2d8ec66e446f1edb466b99ba8d
- SHA1 a94f02b035dc918d8d9a46e6886413f15be5bff0
- SHA512 7e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 144B
- SHA256 f1093c09a840b9ef9c7a0b2c15c7e741122070f55d5419f82a1740d14cdd57d4
- MD5 8435335c81ab6db5d0263f591637fcde
- SHA1 31a8984603bd857fbbf548f0bfee32dd17fe1106
- SHA512 8769fb5f6104307c1ff8ee39fef9cb24696cffb1693f29103715b085dddac69d533504e9556d4f2041a48552e7d1f998a37d5119770c8362b0ed78c6aeeaac9a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 191B
- SHA256 bc2e43ada8af732726a0baf953f4f973826763610a8e39d39503061a4570115a
- MD5 a32cac947bf96ffffa6655e35afdc52a
- SHA1 7de36712ec76416d21f78d5b484b2d4a10a5dfc6
- SHA512 537dc375361a9cf94369c0c2a6b67837041b055de7ee95e88e5164134bb96680bc4a7127473c4e67d49d83cf8070ae26ce6c5701844e2ca250857297cb64996b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 409B
- SHA256 99baf1d12a2f80e4e7d4ec4fae88054aa4d32e06a0ff749923ce7477470f71cb
- MD5 593f87230ef01dcdadbebf9d99e0f7d8
- SHA1 84b85d8ad16102db25bebe8bbfb5f0de16109b40
- SHA512 e3bbb3ec36827195b5372440b6885f10f5d50e5b541465eef0fefb630ecc33bb9f74d22db99269ce6afbf1d8b782cf12ffa452666046bc24a32c7fa54a190182
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 14a009979e10339429d8d3637ec38bf99f9c2370901e7f2bed6efbb690a45bc3
- MD5 6beb69bd325921a12009456ff544f60e
- SHA1 b6c19806f6070454ed0abb771d9f6d601f1ecdb2
- SHA512 60cf6de7cf3cf056581d94a529d2772c64a1b235ea3a46124a7756a4cfcc94db626314ce965a8b33399c311140cb3d286dea72470ee6df3f37381c37cf8ce83c
- SSDEEP 96:njk4Kha1QiZkQqRwpvWMoiVmdeHciOVSUWQyV+VDCziEwb:njkrhaGiGQqRGWMXuEro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 77fb5b0c835e56723e24846223091e3f210ee01211374a9af49575bf41403e2f
- MD5 fabdaa2fe322e633ae6966548d304ca9
- SHA1 23a59be45a3f518e510aa22e83dc1c6c62177fbe
- SHA512 a0bc49f1cb2d8e4a764bd78e6fb2263aa9c6814016adc96100e2b1cdf46681e4244f7508d4b09753cab318713393b27832711dab752689981221303ac13e0a11
- SSDEEP 96:njkzKha1QrZkQqRwpvWMoiVmdemqcDOVSUWQyV+VDCAiEwb:njkuhaGrGQqRGWM2qZErV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 6469ebee42ea47700ebaa4b0c8fe571f36f8f185d04897620c3381f60289aa8d
- MD5 b1f3938a7c16714cd649f759c3467b0d
- SHA1 3ce479f9d0508ce26a7253bfa0729d4494647c4e
- SHA512 1ed52367f174c9706eb31c3698ff391e96ef88d49646b9bacbdf7e523630a399b2c1a081d7097a99db573b402bf77cf00e99118aec12db335967f6938f5cc5c1
- SSDEEP 96:njkzKha1QiZkQqRwpvWMoiVmdeHciOVSUWQyV+VDCAiEwb:njkuhaGiGQqRGWMXuErV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 a473c9ff2a71d3b05ca2af7c103d179de5f95beb0a956e2bbde90722b269cb3e
- MD5 92e961d070062b488633625a5522b45c
- SHA1 4e618fa0df984188b739c67bbe18c88fd3eda943
- SHA512 1a103fd963fe147bc1711d670ac435aa5359c282b7c5c04ea982ba834631db4267f579c9946d52048661d5a688d1c996f441f7753370706038ec7fcaf00e9094
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup6ke2RU4t704hCpFXWx3jcG:A9iIxuERzA83h09RZxY6KK48Q3jcG
- MD5 SHA1 SHA512 SSDEEP