Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
14/09/2024, 11:40
Static task
static1
Behavioral task
behavioral1
Sample
e01b295df176b93933279a23ffa66e8b_JaffaCakes118.html
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
e01b295df176b93933279a23ffa66e8b_JaffaCakes118.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target e01b295df176b93933279a23ffa66e8b_JaffaCakes118.html
- Size 18KB
- Sample240914-ns1rvasdpf
- SHA256 4dc35eeb15d152547c9b99584960bd9034d3e8ecb564f9bed0c3faf851251aa4
- MD5 e01b295df176b93933279a23ffa66e8b
- SHA1 b55bddf1ccb5648e0224f12f19ff756909c017ea
- SHA512 ff2cb76214e91a722efff8c88cf8eb2e9fc5ce54eb9ea08539487c45c970b8604f97d06915d3a77a03a4b546faba6ed38a18056e5d881ef27fded33c8d00062b
- SSDEEP 192:SIM3t0I5fo9cKivXQWxZxdkVSoAIU4YzUnjBh8m82qDB8:SIMd0I5nvHtsv8lxDB8
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 956 msedge.exe 956 msedge.exe 3340 msedge.exe 3340 msedge.exe 3616 msedge.exe 3616 msedge.exe 3616 msedge.exe 3616 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3340 msedge.exe 3340 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3340 wrote to memory of 832 3340 msedge.exe 83 PID 3340 wrote to memory of 832 3340 msedge.exe 83 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 904 3340 msedge.exe 84 PID 3340 wrote to memory of 956 3340 msedge.exe 85 PID 3340 wrote to memory of 956 3340 msedge.exe 85 PID 3340 wrote to memory of 2820 3340 msedge.exe 86 PID 3340 wrote to memory of 2820 3340 msedge.exe 86 PID 3340 wrote to memory of 2820 3340 msedge.exe 86 PID 3340 wrote to memory of 2820 3340 msedge.exe 86 PID 3340 wrote to memory of 2820 3340 msedge.exe 86 PID 3340 wrote to memory of 2820 3340 msedge.exe 86 PID 3340 wrote to memory of 2820 3340 msedge.exe 86 PID 3340 wrote to memory of 2820 3340 msedge.exe 86 PID 3340 wrote to memory of 2820 3340 msedge.exe 86 PID 3340 wrote to memory of 2820 3340 msedge.exe 86 PID 3340 wrote to memory of 2820 3340 msedge.exe 86 PID 3340 wrote to memory of 2820 3340 msedge.exe 86 PID 3340 wrote to memory of 2820 3340 msedge.exe 86 PID 3340 wrote to memory of 2820 3340 msedge.exe 86 PID 3340 wrote to memory of 2820 3340 msedge.exe 86 PID 3340 wrote to memory of 2820 3340 msedge.exe 86 PID 3340 wrote to memory of 2820 3340 msedge.exe 86 PID 3340 wrote to memory of 2820 3340 msedge.exe 86 PID 3340 wrote to memory of 2820 3340 msedge.exe 86 PID 3340 wrote to memory of 2820 3340 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e01b295df176b93933279a23ffa66e8b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b8ed46f8,0x7ff9b8ed4708,0x7ff9b8ed47182⤵PID:832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,4574684461978968021,7186642007700251995,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:22⤵PID:904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,4574684461978968021,7186642007700251995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,4574684461978968021,7186642007700251995,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:82⤵PID:2820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4574684461978968021,7186642007700251995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:1628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4574684461978968021,7186642007700251995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:4640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,4574684461978968021,7186642007700251995,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3616
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1384
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
- MD5 53bc70ecb115bdbabe67620c416fe9b3
- SHA1 af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
- SHA512 cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
- MD5 e765f3d75e6b0e4a7119c8b14d47d8da
- SHA1 cc9f7c7826c2e1a129e7d98884926076c3714fc0
- SHA512 a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 55059746b0bf176092d5fc330d02029c007be0817a2b1ca79295e47574a59eab
- MD5 d1cce7da743cf896855b029859e4f567
- SHA1 5382a2f29e3ced835df9af12b4f6da449e593679
- SHA512 469f7754e9b1a9b4be86cf15a7663e6f4df8fb0f4aab9a997f4b66f447609c18950a083eca0547adf149532c752ec4b25866067add4c49c5ac89116e8049950a
- SSDEEP 96:nWkzepc1SRQwpvWMoiVmdeH85qCw+UWQyV+VDCAiEwb:nWkz9wRQGWMXz+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 1b1505bb87ab9789ddac0106d2da073703b2774810f8013ae188cc1dfe1f08de
- MD5 0d9a036b9a118d4ddb679eb0ea316395
- SHA1 4138e0e9ed6354f1bae0d6bb269f388850da19ef
- SHA512 dd276db96713fa5ea1465bf6267433c6f06c2c13544f8c571e31009b4ec8072efa3c802d378bbbd1d39600642e8233658f85f083c8e984034e5a8a7662b7a5c4
- SSDEEP 96:nWkz0pc1SRQwpvWMoiVmdeH85qCw+UWQyV+VDCziEwb:nWkz3wRQGWMXz+ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 e54cb26eb39b5c1de728e38522cc93278777547b7691f3f532b31a61fafd01f3
- MD5 8f336260e5ddcb728b49f020333e6271
- SHA1 afcefd8c1d38f016c91786c3eadaac61e385962b
- SHA512 72cbc5854ea8afd45d5c752d49f53d1c9cc8fbe51d1077d6e137565dde5bd39fee0b03a50b8eaabd62635d678a35a86bf4279836de7e0e29b170d4dd74f8d3f1
- SSDEEP 96:nWkzepc1SyQwpvWMoiVmdeH85qCw+UWQyV+VDCAiEwb:nWkz9wyQGWMXz+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 0d6c102117f0c20ab08ea04252dadb224075ff0f35cbee015e3365f32bab6146
- MD5 fa55de6cc2199d4aad29373170242da5
- SHA1 8221cd28d82e665c95f9723886df4a25f648937c
- SHA512 0e7fee6a310d736e203044e9e57cb0e1ff6ccf7ee8e37ae88549b68de42babbe6a42a5ee49c71ee3539ba9dfcbf2cbac5403074c9391823605a872f67da3c3f2
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupCRclMe2RUL/7i+vTeuLJ59:A9iIxuERzA83h09RZxY+oSiTVv7JCY
- MD5 SHA1 SHA512 SSDEEP