Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
02/10/2024, 00:11
Static task
static1
Behavioral task
behavioral1
Sample
07ffdd117217d5710d1a65a798191947_JaffaCakes118.html
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
07ffdd117217d5710d1a65a798191947_JaffaCakes118.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 07ffdd117217d5710d1a65a798191947_JaffaCakes118.html
- Size 138KB
- Sample241002-agt82a1eqd
- SHA256 4fd8b18ee49af73cc9e39ab1467139621fe3a4a297c2e71b9ae18099e7b0c15d
- MD5 07ffdd117217d5710d1a65a798191947
- SHA1 1d8d6ad8f64775241d78a29437bd52b73fb58287
- SHA512 80757c5781d3b51333cc2b1de75cd3f22cecd3f445bfabf1f4da82b4a74412d10251b7a4e0347cc942e99f2daed305dc96842118caca278c66cc1a67c923a0e8
- SSDEEP 1536:SRZXUVTd3lBYyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:SRygyfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4464 msedge.exe 4464 msedge.exe 4624 msedge.exe 4624 msedge.exe 2260 msedge.exe 2260 msedge.exe 2260 msedge.exe 2260 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4624 msedge.exe 4624 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4624 wrote to memory of 1868 4624 msedge.exe 81 PID 4624 wrote to memory of 1868 4624 msedge.exe 81 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 1300 4624 msedge.exe 82 PID 4624 wrote to memory of 4464 4624 msedge.exe 83 PID 4624 wrote to memory of 4464 4624 msedge.exe 83 PID 4624 wrote to memory of 1064 4624 msedge.exe 84 PID 4624 wrote to memory of 1064 4624 msedge.exe 84 PID 4624 wrote to memory of 1064 4624 msedge.exe 84 PID 4624 wrote to memory of 1064 4624 msedge.exe 84 PID 4624 wrote to memory of 1064 4624 msedge.exe 84 PID 4624 wrote to memory of 1064 4624 msedge.exe 84 PID 4624 wrote to memory of 1064 4624 msedge.exe 84 PID 4624 wrote to memory of 1064 4624 msedge.exe 84 PID 4624 wrote to memory of 1064 4624 msedge.exe 84 PID 4624 wrote to memory of 1064 4624 msedge.exe 84 PID 4624 wrote to memory of 1064 4624 msedge.exe 84 PID 4624 wrote to memory of 1064 4624 msedge.exe 84 PID 4624 wrote to memory of 1064 4624 msedge.exe 84 PID 4624 wrote to memory of 1064 4624 msedge.exe 84 PID 4624 wrote to memory of 1064 4624 msedge.exe 84 PID 4624 wrote to memory of 1064 4624 msedge.exe 84 PID 4624 wrote to memory of 1064 4624 msedge.exe 84 PID 4624 wrote to memory of 1064 4624 msedge.exe 84 PID 4624 wrote to memory of 1064 4624 msedge.exe 84 PID 4624 wrote to memory of 1064 4624 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\07ffdd117217d5710d1a65a798191947_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9da7946f8,0x7ff9da794708,0x7ff9da7947182⤵PID:1868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2851026751691165190,13353500293915782964,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:1300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,2851026751691165190,13353500293915782964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,2851026751691165190,13353500293915782964,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:82⤵PID:1064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2851026751691165190,13353500293915782964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2851026751691165190,13353500293915782964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:2660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2851026751691165190,13353500293915782964,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2260
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1188
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
- MD5 9b008261dda31857d68792b46af6dd6d
- SHA1 e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
- SHA512 78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
- MD5 0446fcdd21b016db1f468971fb82a488
- SHA1 726b91562bb75f80981f381e3c69d7d832c87c9d
- SHA512 1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 1b12fdfb2d424832b98c6f948c896adfc2dea0e1ac37a5bc14621c82b9520409
- MD5 1d0b819ceb403a72c0112d7c172af712
- SHA1 a0af9323fbbd62362ab106b5404b3fcc3013f29c
- SHA512 6c7a7e7b713fde9087d8c9ade4889dc15ad0d766ead0ec7b9bb632fdc92042d91e6d5bc95b233381a44c3189fed724e6dac0ecc99a1c9d57d21e9e6671f835f8
- SSDEEP 96:n8kd20x1FsdwpvWMoiVmdeH/ddyzUWQyV+VDCziEwb:n8kdRxXaGWMX1Izro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 83732569e52e3d2e326c547a34d81e7c104165894680bbbea0d82a385c746342
- MD5 7a434c17c77b178a400c6e53906ec6b3
- SHA1 070fd8857bfbb25c81f32a4b1b38afddd4cf55c7
- SHA512 f40dbbd8dc659c240df4691c8fc1fcc09a4683b075b27bd84d8aa5c99993c9300883b71f1b72f4c01903d052d31fbfd18b75c2666b8ae0374e91a10efae4997c
- SSDEEP 96:n8kdo0x1FtdwpvWMoiVmdeH/ddyzUWQyV+VDCAiEwb:n8kdfxXHGWMX1IzrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 8bb78b5f7d9ddb6faecb043b407545b4cbd874a3ba9e87f64f2f38c8817a2317
- MD5 347199ce5454bb9be5ded4be388aa51f
- SHA1 5cc69dad2f533d0f6bbf323e64781f555e7a9406
- SHA512 1ad8829c10729b58cdf8f5df4559018e564017c05b756ca5b0dedecc4c798723babb99d9d7627f8f4bb3c350c20802214778e564afdaf5c14fb1720fe2982441
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZ1ke2RUt923IaIcM/bo5Z1:A9iIxuERzA83h09RZxY6bYTqZxP
- MD5 SHA1 SHA512 SSDEEP