Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
07/09/2024, 08:03
Static task
static1
Behavioral task
behavioral1
Sample
d173dc2f056ead29afe44038ba597645_JaffaCakes118.html
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
d173dc2f056ead29afe44038ba597645_JaffaCakes118.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target d173dc2f056ead29afe44038ba597645_JaffaCakes118.html
- Size 18KB
- Sample240907-jx239atenh
- SHA256 78e2b93deeb53dd32ac65c0e2d489d2145be9f58c6fd1cfe6c8bd3a306530cdf
- MD5 d173dc2f056ead29afe44038ba597645
- SHA1 8cb9315d33b2fbef6c292ce73808a5725013889c
- SHA512 e3be0a7bb4deb7addef7a7f1329a855065a23c554c1fc29af82529a11be54b97817c41698a70d08e7e328afdef7f1769c6988cd0260885c3168bd43157572198
- SSDEEP 192:SIM3t0I5fo9cKivXQWxZxdkVSoAIY4GzUnjBhSU82qDB8:SIMd0I5nvHjsvSXxDB8
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5096 msedge.exe 5096 msedge.exe 540 msedge.exe 540 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 540 msedge.exe 540 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 540 wrote to memory of 3996 540 msedge.exe 83 PID 540 wrote to memory of 3996 540 msedge.exe 83 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 700 540 msedge.exe 84 PID 540 wrote to memory of 5096 540 msedge.exe 85 PID 540 wrote to memory of 5096 540 msedge.exe 85 PID 540 wrote to memory of 532 540 msedge.exe 86 PID 540 wrote to memory of 532 540 msedge.exe 86 PID 540 wrote to memory of 532 540 msedge.exe 86 PID 540 wrote to memory of 532 540 msedge.exe 86 PID 540 wrote to memory of 532 540 msedge.exe 86 PID 540 wrote to memory of 532 540 msedge.exe 86 PID 540 wrote to memory of 532 540 msedge.exe 86 PID 540 wrote to memory of 532 540 msedge.exe 86 PID 540 wrote to memory of 532 540 msedge.exe 86 PID 540 wrote to memory of 532 540 msedge.exe 86 PID 540 wrote to memory of 532 540 msedge.exe 86 PID 540 wrote to memory of 532 540 msedge.exe 86 PID 540 wrote to memory of 532 540 msedge.exe 86 PID 540 wrote to memory of 532 540 msedge.exe 86 PID 540 wrote to memory of 532 540 msedge.exe 86 PID 540 wrote to memory of 532 540 msedge.exe 86 PID 540 wrote to memory of 532 540 msedge.exe 86 PID 540 wrote to memory of 532 540 msedge.exe 86 PID 540 wrote to memory of 532 540 msedge.exe 86 PID 540 wrote to memory of 532 540 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d173dc2f056ead29afe44038ba597645_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87df646f8,0x7ff87df64708,0x7ff87df647182⤵PID:3996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,6763151151446657045,12643289887699123921,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵PID:700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,6763151151446657045,12643289887699123921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,6763151151446657045,12643289887699123921,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2500 /prefetch:82⤵PID:532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6763151151446657045,12643289887699123921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:12⤵PID:3032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6763151151446657045,12643289887699123921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:12⤵PID:2528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,6763151151446657045,12643289887699123921,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3132 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3152
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1052
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
- MD5 ecf7ca53c80b5245e35839009d12f866
- SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
- SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
- MD5 4dd2754d1bea40445984d65abee82b21
- SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
- SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 2cf98c6f3608f34a6b4038962e8650e55af7c6e2862ccbbf94d17f66e639b2ee
- MD5 5decc136ce8fe537b89cf99ee8c09e5c
- SHA1 8cf6d0db93e6f6cf7e173b219c8cb0e1cc75c15c
- SHA512 f51feefd2e797b17507178282740d81bcccdd9184fdf2f9d34890551c18dc62e3a43216d8bec78ba38858dbba65527f0a11192242399647722661efa3b8f77ce
- SSDEEP 96:nDk8tmXF1x2zTNwpvWMoiVmdeH44YAsUWQyV+VDCziEwb:nDkH1b2VGWMX4pro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 b26727706548939b223bf9bdbf3e9bff139d63dcb3c3330be5efadbb7902320e
- MD5 fbf5b1c7985564c7b7cab7246f3dc966
- SHA1 d839d9ca2a32bfaff699e3a5ca1d81be44b4afa0
- SHA512 45f678f0f042f94c4862c5003c7837f64df389f07e85c97a8e506efac6a6c7a147af83cc289e6c286e0b92a03cb8fe3d19e360d2bbd32bc4b7d8423e73706f16
- SSDEEP 96:nDk8tmPF1x2zTNwpvWMoiVmdeH44YAsUWQyV+VDCAiEwb:nDkH9b2VGWMX4prV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 d44fba59e7229222e5254e4589e8b3add03727cad250a5afb72a69199ad246ee
- MD5 e2e32087357ebeb481b2187004a7c3ac
- SHA1 20aeaa7d096710c2eb2c0b44972c3940ffc22740
- SHA512 58714870af5ccf1e4de66953744cf0831463fcebf5c5d8871174771b515db561944564d608bc1da32c17afabf4cfa3cb8d037f3df177300e198addbcf592f3cf
- SSDEEP 96:nDk8tmPF1x2cTNwpvWMoiVmdeH44YAsUWQyV+VDCAiEwb:nDkH9b2cGWMX4prV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 d1b035516891910275ff75baed0353c2c932f350c38a0a0eb5a5e99940fc9c9b
- MD5 a8980addd7bcc78eca45199255145206
- SHA1 9c24f9bfd17e98aaadebc687784aab70aa7be27a
- SHA512 251e7b44ec19cce486d5897ec5421c2959fbc22b2c539f2b0adb077657381029dfb34f736a54b5ceec6a38b684bc484525ccd2aea99611f77af4c2db1c375e61
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupEe2RULOkTLQOl6feAOe:A9iIxuERzA83h09RZxYq0TSv
- MD5 SHA1 SHA512 SSDEEP