Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
19/09/2024, 15:28
Static task
static1
Behavioral task
behavioral1
Sample
eba12b758938219b7d1b7ea381f65977_JaffaCakes118.html
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
eba12b758938219b7d1b7ea381f65977_JaffaCakes118.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target eba12b758938219b7d1b7ea381f65977_JaffaCakes118.html
- Size 159KB
- Sample240919-swkl9awblh
- SHA256 13df8f7fcfa46d565f5f7efd068c5f7fac29bbfa21071a19dabd4f633a4a5138
- MD5 eba12b758938219b7d1b7ea381f65977
- SHA1 80450de257bfeda9b417ef0a16dcc006ab590852
- SHA512 5e39b90854499fb30dc92af95ea7bb7c9fdb1a14088f6efb544b6539d39916695425b5df6c6b757b422aa0979a2c91434113a3c49ab94f5d2e1162fee6f0c340
- SSDEEP 3072:ScLlvNZX00yfkMY+BES09JXAnyrZalI+YQ:SchNxEsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2276 msedge.exe 2276 msedge.exe 1468 msedge.exe 1468 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1468 msedge.exe 1468 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1468 wrote to memory of 1392 1468 msedge.exe 83 PID 1468 wrote to memory of 1392 1468 msedge.exe 83 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 5016 1468 msedge.exe 84 PID 1468 wrote to memory of 2276 1468 msedge.exe 85 PID 1468 wrote to memory of 2276 1468 msedge.exe 85 PID 1468 wrote to memory of 1796 1468 msedge.exe 86 PID 1468 wrote to memory of 1796 1468 msedge.exe 86 PID 1468 wrote to memory of 1796 1468 msedge.exe 86 PID 1468 wrote to memory of 1796 1468 msedge.exe 86 PID 1468 wrote to memory of 1796 1468 msedge.exe 86 PID 1468 wrote to memory of 1796 1468 msedge.exe 86 PID 1468 wrote to memory of 1796 1468 msedge.exe 86 PID 1468 wrote to memory of 1796 1468 msedge.exe 86 PID 1468 wrote to memory of 1796 1468 msedge.exe 86 PID 1468 wrote to memory of 1796 1468 msedge.exe 86 PID 1468 wrote to memory of 1796 1468 msedge.exe 86 PID 1468 wrote to memory of 1796 1468 msedge.exe 86 PID 1468 wrote to memory of 1796 1468 msedge.exe 86 PID 1468 wrote to memory of 1796 1468 msedge.exe 86 PID 1468 wrote to memory of 1796 1468 msedge.exe 86 PID 1468 wrote to memory of 1796 1468 msedge.exe 86 PID 1468 wrote to memory of 1796 1468 msedge.exe 86 PID 1468 wrote to memory of 1796 1468 msedge.exe 86 PID 1468 wrote to memory of 1796 1468 msedge.exe 86 PID 1468 wrote to memory of 1796 1468 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eba12b758938219b7d1b7ea381f65977_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba9d046f8,0x7ffba9d04708,0x7ffba9d047182⤵PID:1392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,4897323664453494509,5194566787271840988,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:22⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,4897323664453494509,5194566787271840988,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,4897323664453494509,5194566787271840988,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:82⤵PID:1796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4897323664453494509,5194566787271840988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4897323664453494509,5194566787271840988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:1832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,4897323664453494509,5194566787271840988,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5032 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4552
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1704
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
- MD5 9b008261dda31857d68792b46af6dd6d
- SHA1 e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
- SHA512 78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
- MD5 0446fcdd21b016db1f468971fb82a488
- SHA1 726b91562bb75f80981f381e3c69d7d832c87c9d
- SHA512 1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 873c71d67fff8c215c663f75119fed28ce6333ce247f3b5814a9811bc20b808a
- MD5 8eafc06233a2a0337eec4f741fbebf8d
- SHA1 8e5d2b7c5f5973263d130048dda016765a67f531
- SHA512 1beee69c9531de2347a86bf114510031b105bf1a85aa4819685593e82cc21bc5e0f20cfb34ef081b8aefc4f972d67ed8c6b6508fa300e912ca71a888e47d825a
- SSDEEP 96:nIk/hXN124dwpvWMoiVmdeH/ddTUWQyV+VDCziEwb:nIk/VN0eGWMX1tro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 61a21604d3229358af1806e210dd548bbc59900b8d193653517ee7d39e6ca42a
- MD5 bdd4daada3a8b02dd4b187e53eb17f23
- SHA1 1dc33f7ccd16ad3d01d0c3c98d61be6ce90450f6
- SHA512 fe8dc718c4517d73e68cccb10ad565f8fee3867fa2ebc811276ae31ba463bc613889fc326fd71a953cca60a65e9733eb0fc0a633404ea14f23d83cd12c018bd3
- SSDEEP 96:nIk/MoXN125dwpvWMoiVmdeH/ddTUWQyV+VDCAiEwb:nIk/9N0bGWMX1trV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 32627e47d841d5ee86bd54e7b218741cfe4832afc69fe25e2120fffbf18b03bc
- MD5 8cee3f693f02984845aa71f1dc4bb035
- SHA1 6ba61b0fed59b8e2f593e35e6712fa5c30e14680
- SHA512 acd23e02c7feccf4aaa1a55a4dba137d48ce72ce32aad2728eaee6c72ae14de4c115b5f1ae092e73ab4cc391833fdec007310b498061cfeb86a5a8a687066040
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupo5e2RUR23InIcM/bo5ZxQ:A9iIxuERzA83h09RZxYY5YYqZxQ
- MD5 SHA1 SHA512 SSDEEP