Analysis
- max time kernel
148s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
29/08/2024, 19:38
Static task
static1
Behavioral task
behavioral1
Sample
c97f50408b4896253e960d893aa4fd4e_JaffaCakes118.html
Resource
win7-20240705-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
c97f50408b4896253e960d893aa4fd4e_JaffaCakes118.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target c97f50408b4896253e960d893aa4fd4e_JaffaCakes118.html
- Size 8KB
- Sample240829-ycws3axfre
- SHA256 6b99b282934e707868c777a5ffd5d42ba993c966a9d5b4c7bd471bd798bbcff2
- MD5 c97f50408b4896253e960d893aa4fd4e
- SHA1 7e213bfc80d1d6339e2469452acccca717dec96d
- SHA512 b5cf6930e344847dc0c3f3e4bb3e2210f0ac3987d198f1052bbff6e64028de58e6388ae00842ce0d2dfcfe2db9434c298537093ffd5734778c8059bb47459c45
- SSDEEP 192:SIxBLZMtKytuinvmQ3Frd5Xpd5Xje4Ga6:SIxa93xd55d5iJ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3528 msedge.exe 3528 msedge.exe 1056 msedge.exe 1056 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1056 wrote to memory of 384 1056 msedge.exe 85 PID 1056 wrote to memory of 384 1056 msedge.exe 85 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 632 1056 msedge.exe 86 PID 1056 wrote to memory of 3528 1056 msedge.exe 87 PID 1056 wrote to memory of 3528 1056 msedge.exe 87 PID 1056 wrote to memory of 4220 1056 msedge.exe 88 PID 1056 wrote to memory of 4220 1056 msedge.exe 88 PID 1056 wrote to memory of 4220 1056 msedge.exe 88 PID 1056 wrote to memory of 4220 1056 msedge.exe 88 PID 1056 wrote to memory of 4220 1056 msedge.exe 88 PID 1056 wrote to memory of 4220 1056 msedge.exe 88 PID 1056 wrote to memory of 4220 1056 msedge.exe 88 PID 1056 wrote to memory of 4220 1056 msedge.exe 88 PID 1056 wrote to memory of 4220 1056 msedge.exe 88 PID 1056 wrote to memory of 4220 1056 msedge.exe 88 PID 1056 wrote to memory of 4220 1056 msedge.exe 88 PID 1056 wrote to memory of 4220 1056 msedge.exe 88 PID 1056 wrote to memory of 4220 1056 msedge.exe 88 PID 1056 wrote to memory of 4220 1056 msedge.exe 88 PID 1056 wrote to memory of 4220 1056 msedge.exe 88 PID 1056 wrote to memory of 4220 1056 msedge.exe 88 PID 1056 wrote to memory of 4220 1056 msedge.exe 88 PID 1056 wrote to memory of 4220 1056 msedge.exe 88 PID 1056 wrote to memory of 4220 1056 msedge.exe 88 PID 1056 wrote to memory of 4220 1056 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c97f50408b4896253e960d893aa4fd4e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ff90daf46f8,0x7ff90daf4708,0x7ff90daf47182⤵PID:384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,11415780272980655414,14720507563187162944,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:22⤵PID:632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,11415780272980655414,14720507563187162944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,11415780272980655414,14720507563187162944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:82⤵PID:4220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,11415780272980655414,14720507563187162944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:3956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,11415780272980655414,14720507563187162944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:1288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,11415780272980655414,14720507563187162944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:12⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,11415780272980655414,14720507563187162944,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1344 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2340
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2716
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
- MD5 e4f80e7950cbd3bb11257d2000cb885e
- SHA1 10ac643904d539042d8f7aa4a312b13ec2106035
- SHA512 2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
- MD5 2dc1a9f2f3f8c3cfe51bb29b078166c5
- SHA1 eaf3c3dad3c8dc6f18dc3e055b415da78b704402
- SHA512 682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 caca9c894e157a72d0f07d5d3e219cc66d992c6eb81494c5c3e495f0bed88723
- MD5 6b90f2dacd2a7f2a568b530f558a7ff7
- SHA1 17146dd3f1e47ccdfe29c27d871b6a2a378992cf
- SHA512 12bd3675da6abdb0550e475fab81d9bf4f39ea76a50cf02e7e51db7f69ac2a165f2bd54d9756d21fcddefec8c777f6b7d0f4a53f6f404afcd23ce5f21ae2b539
- SSDEEP 96:nDikxaTR18ATtwpvWMoiVmdeHTbZKAUWQyV+VDCziEwb:nukxm+uGWMX/QAro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 366adc261de86abf232edd922fc97b30bf3b772cbf76d8dd65ecf9d3e09758a5
- MD5 8b2e60b41c1c04fb7163bb8aebf6c303
- SHA1 aa7b4c0384a62e0140de179a3cf07ee0a6d9963e
- SHA512 a5e2256aec0d6ff845f1380f90d1464f1a8a59f4b04554a3a11c215d72029aa1d21df9ab99c91de24a07293617582a4a6caa43bbffa7a41c3965f9fb3a11cebf
- SSDEEP 96:nDikxETR18ATtwpvWMoiVmdeHTbZKAUWQyV+VDCAiEwb:nukxU+uGWMX/QArV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 55ab045a4c7426f1775e1613dc9524847b109266e8787529a39c42fabf9e938d
- MD5 9bb759fa3372f2df2d51f715274831a8
- SHA1 de605b85d8da045f4002744fa4599fc25189452e
- SHA512 42d410b2ae285da4a54ae56b79db052f34f873164d848906feb31516a2a4574e214b7f7034b96e2d48a514e0dade32fff275de6765d120275b6ca091d3a8794c
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupiGe2RU+zkjrRw5Ytj9Zklr:A9iIxuERzA83h09RZxYiIyskLsjTP
- MD5 SHA1 SHA512 SSDEEP