Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
21/09/2024, 09:28
Static task
static1
Behavioral task
behavioral1
Sample
ef80848353974526f552e0f63ea64e5f_JaffaCakes118.html
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ef80848353974526f552e0f63ea64e5f_JaffaCakes118.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target ef80848353974526f552e0f63ea64e5f_JaffaCakes118.html
- Size 158KB
- Sample240921-lfrx3avgnp
- SHA256 d6091700851e049124e06594472aab7448428cb889e765d951d87d102290c2b4
- MD5 ef80848353974526f552e0f63ea64e5f
- SHA1 afb0a53f5cff06ff03dd91f2c678fe24cf92ca0f
- SHA512 f4c616af89d1a4654d56587e77e850f3b7a14cb31cbbc35938bc9e18368f22f7d5cf692d48b9edf1c794747ef1a97b8d6d3c0aad8f339a169e9ab45f2c63fac4
- SSDEEP 3072:SGHAdsJSNyfkMY+BES09JXAnyrZalI+YQ:SGHAidsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4196 msedge.exe 4196 msedge.exe 3140 msedge.exe 3140 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3140 msedge.exe 3140 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3140 wrote to memory of 4420 3140 msedge.exe 82 PID 3140 wrote to memory of 4420 3140 msedge.exe 82 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 3604 3140 msedge.exe 83 PID 3140 wrote to memory of 4196 3140 msedge.exe 84 PID 3140 wrote to memory of 4196 3140 msedge.exe 84 PID 3140 wrote to memory of 4268 3140 msedge.exe 85 PID 3140 wrote to memory of 4268 3140 msedge.exe 85 PID 3140 wrote to memory of 4268 3140 msedge.exe 85 PID 3140 wrote to memory of 4268 3140 msedge.exe 85 PID 3140 wrote to memory of 4268 3140 msedge.exe 85 PID 3140 wrote to memory of 4268 3140 msedge.exe 85 PID 3140 wrote to memory of 4268 3140 msedge.exe 85 PID 3140 wrote to memory of 4268 3140 msedge.exe 85 PID 3140 wrote to memory of 4268 3140 msedge.exe 85 PID 3140 wrote to memory of 4268 3140 msedge.exe 85 PID 3140 wrote to memory of 4268 3140 msedge.exe 85 PID 3140 wrote to memory of 4268 3140 msedge.exe 85 PID 3140 wrote to memory of 4268 3140 msedge.exe 85 PID 3140 wrote to memory of 4268 3140 msedge.exe 85 PID 3140 wrote to memory of 4268 3140 msedge.exe 85 PID 3140 wrote to memory of 4268 3140 msedge.exe 85 PID 3140 wrote to memory of 4268 3140 msedge.exe 85 PID 3140 wrote to memory of 4268 3140 msedge.exe 85 PID 3140 wrote to memory of 4268 3140 msedge.exe 85 PID 3140 wrote to memory of 4268 3140 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ef80848353974526f552e0f63ea64e5f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff77ca46f8,0x7fff77ca4708,0x7fff77ca47182⤵PID:4420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,12038570240746045105,17631776474057454018,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,12038570240746045105,17631776474057454018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,12038570240746045105,17631776474057454018,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12038570240746045105,17631776474057454018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12038570240746045105,17631776474057454018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,12038570240746045105,17631776474057454018,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3060 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4508
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2716
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
- MD5 9b008261dda31857d68792b46af6dd6d
- SHA1 e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
- SHA512 78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
- MD5 0446fcdd21b016db1f468971fb82a488
- SHA1 726b91562bb75f80981f381e3c69d7d832c87c9d
- SHA512 1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 5c9bbc08b7872ddd4ed523815654a20791f63ab2f8222cf828604a90e22cbc6a
- MD5 d223ca623a28974a5b56a84762b9b616
- SHA1 5b6fab76e4fa416402fa1b6e93b803d8a99aa9c8
- SHA512 e36a516abe7eae1ffb6adb0c50995e3fca809274631c8fa713a7d363416827e2a44612e66029f0962c1888d88bc6fc22d97723759d2e0930b759f5672f7a482f
- SSDEEP 96:nqkRhq1DywgdwpvWMoiVmdeH/ddTUWQyV+VDCziEwb:nqkRc4wWGWMX1hro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 3c2bee860beca7198e9616f9e8ae2b7c5472fa544fc727405e2790a5aa69baab
- MD5 9de217b4d65e184096b664d94dd01d54
- SHA1 bc308b424f84fefed93065ab3465467b09eacaf3
- SHA512 29fd5f0b4e75d675f909eeb0d5f0121530da777f472ee54f780d0857e07d32571922c5daf12c1303fca8b2b6a72db59d87e9e8764b14d3912e9955e6665b5c02
- SSDEEP 96:nqkRMoq1DywBdwpvWMoiVmdeH/ddTUWQyV+VDCAiEwb:nqkRU4wTGWMX1hrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 6276a2a9bb8cff7b7ca24c2f6719d8de8d775f5de88f7ff42d24b6e01764e146
- MD5 ecd57281f2a4e158f92c7f2dabb88de1
- SHA1 a05e442e444c375ffcd6f974183cfce55130400a
- SHA512 4d76ea47e94863165f0e6724e93220dd57e24507ca5c72fbd9c64845a7304b579ac80e186ed598dd6efa20087e9b872129b81149980a1bc6c32cf033bdc87e8f
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZye2RUt23IqIcM/bo5ZxZ:A9iIxuERzA83h09RZxYa1YDqZxZ
- MD5 SHA1 SHA512 SSDEEP