Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
21/09/2024, 12:48
Static task
static1
Behavioral task
behavioral1
Sample
efd4a9630be4668c4937454e32cf9106_JaffaCakes118.html
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
efd4a9630be4668c4937454e32cf9106_JaffaCakes118.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target efd4a9630be4668c4937454e32cf9106_JaffaCakes118.html
- Size 108KB
- Sample240921-p14zxasgkd
- SHA256 248b1f63dbb6071b26bcb8c7042a4807ddaca5bfa5dd661944cc80d9ff6f4703
- MD5 efd4a9630be4668c4937454e32cf9106
- SHA1 f02e14d8a9251ddd7122f3aaaf6345c17857ee4e
- SHA512 b9199901a70306e25dc1a261c478f8b1de8683b63f800e2aeba52d36e33d6b5f9f4fc893780b23870915563affc389b60917ddc499425ddfe00861ce5276b668
- SSDEEP 1536:SapoFDYoTE0FyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrus1:Sak7FyfkMY+BES09JXAny9
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2952 msedge.exe 2952 msedge.exe 4484 msedge.exe 4484 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4484 msedge.exe 4484 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4484 wrote to memory of 2948 4484 msedge.exe 82 PID 4484 wrote to memory of 2948 4484 msedge.exe 82 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 4916 4484 msedge.exe 83 PID 4484 wrote to memory of 2952 4484 msedge.exe 84 PID 4484 wrote to memory of 2952 4484 msedge.exe 84 PID 4484 wrote to memory of 3692 4484 msedge.exe 85 PID 4484 wrote to memory of 3692 4484 msedge.exe 85 PID 4484 wrote to memory of 3692 4484 msedge.exe 85 PID 4484 wrote to memory of 3692 4484 msedge.exe 85 PID 4484 wrote to memory of 3692 4484 msedge.exe 85 PID 4484 wrote to memory of 3692 4484 msedge.exe 85 PID 4484 wrote to memory of 3692 4484 msedge.exe 85 PID 4484 wrote to memory of 3692 4484 msedge.exe 85 PID 4484 wrote to memory of 3692 4484 msedge.exe 85 PID 4484 wrote to memory of 3692 4484 msedge.exe 85 PID 4484 wrote to memory of 3692 4484 msedge.exe 85 PID 4484 wrote to memory of 3692 4484 msedge.exe 85 PID 4484 wrote to memory of 3692 4484 msedge.exe 85 PID 4484 wrote to memory of 3692 4484 msedge.exe 85 PID 4484 wrote to memory of 3692 4484 msedge.exe 85 PID 4484 wrote to memory of 3692 4484 msedge.exe 85 PID 4484 wrote to memory of 3692 4484 msedge.exe 85 PID 4484 wrote to memory of 3692 4484 msedge.exe 85 PID 4484 wrote to memory of 3692 4484 msedge.exe 85 PID 4484 wrote to memory of 3692 4484 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\efd4a9630be4668c4937454e32cf9106_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe832046f8,0x7ffe83204708,0x7ffe832047182⤵PID:2948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1804,13835986566904931634,8983258599560258006,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:22⤵PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1804,13835986566904931634,8983258599560258006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1804,13835986566904931634,8983258599560258006,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:82⤵PID:3692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,13835986566904931634,8983258599560258006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,13835986566904931634,8983258599560258006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1804,13835986566904931634,8983258599560258006,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3048
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3252
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
- MD5 eeaa8087eba2f63f31e599f6a7b46ef4
- SHA1 f639519deee0766a39cfe258d2ac48e3a9d5ac03
- SHA512 eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
- MD5 b9569e123772ae290f9bac07e0d31748
- SHA1 5806ed9b301d4178a959b26d7b7ccf2c0abc6741
- SHA512 cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 111B
- SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
- MD5 807419ca9a4734feaf8d8563a003b048
- SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
- SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 07f8283132dac0c86a2e70a749128f0d1364ba20e87b449d813cc38d6c540722
- MD5 e907f878194350e9f8b264874957bac0
- SHA1 1c5e73de59caee3b728ca154caa09a7153c109a4
- SHA512 ee6737f5031a58b4752ade3a38b5923da2fb9e66a050b32eebf5727ef9bc88df41981aa105484978bda447c40ce180dc4b1bada7919468bd0cecf5aca948f0d9
- SSDEEP 96:nKkRhr1LOwpvWMoiVmdeHk8IUUWQyV+VDCziEwb:nKkRBhOGWMXyUro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 25d9bcd4070e82c8f24d0f83b683e9ef1255edf16a57a851fc358065545d4f29
- MD5 a1cf50fcac6d96e4ab05ba479351be42
- SHA1 15242a718a330a652dea425d13e782a2c1484611
- SHA512 5e4460fcf18a444e09eeb71020cc3443c3400c9cfe385954dfe4ef856374ad264b3c59318b0797c99c0fd6ad9d93776709eaacd42d9e06457ee0a863f830cd3a
- SSDEEP 96:nKkRhr1LzwpvWMoiVmdeHk8IUUWQyV+VDCAiEwb:nKkRBhzGWMXyUrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 3a3d89d96b75c08456af488c3ac01f34fd51105f04fb5475765d4f26b999507e
- MD5 60fb8050a9b14f34a93bf4aaf82f5ee5
- SHA1 4b1026ebc275ce0cfd473aa4a695f9751338ab1e
- SHA512 7892f4e14e1df93c07ac8cc87ff49ce6018c6136628a0ac3f84d447356faccbd89965735030fa2381d5c231bedbd53eb8812b2a93d639cbad032c7bda7ec69a2
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupnze2RUbxnoK:A9iIxuERzA83h09RZxYj+oK
- MD5 SHA1 SHA512 SSDEEP