Analysis
- max time kernel
145s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
03/10/2024, 22:30
Static task
static1
Behavioral task
behavioral1
Sample
10bfecf799b3d682ed88d77409f0bd07_JaffaCakes118.html
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
10bfecf799b3d682ed88d77409f0bd07_JaffaCakes118.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 10bfecf799b3d682ed88d77409f0bd07_JaffaCakes118.html
- Size 85KB
- Sample241003-2ety2atejc
- SHA256 ef5ee4f42328729fdfe6144804b70d04b49763fa67737eb83a8952572459d580
- MD5 10bfecf799b3d682ed88d77409f0bd07
- SHA1 dd81bf82b70e0d9abf9a365e5eff23dd31602ceb
- SHA512 b0c867a9bcf06bce75cda01dee467f4ae334c2d478ef472867372aa6de7514237d06645a9bc12f77d4c79ae8eb4abbe776babc75c556eed3b32e53da92b1d3a7
- SSDEEP 1536:/+ipVn1BUNqvLKvr7R/mnVvWCUjSo0mjiMpbqqvmznhKv++nPLB1VI:/BvLKvr7RqUiyuznhKv++nTB1W
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3320 msedge.exe 3320 msedge.exe 1444 msedge.exe 1444 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1444 msedge.exe 1444 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1444 wrote to memory of 1780 1444 msedge.exe 82 PID 1444 wrote to memory of 1780 1444 msedge.exe 82 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 5028 1444 msedge.exe 83 PID 1444 wrote to memory of 3320 1444 msedge.exe 84 PID 1444 wrote to memory of 3320 1444 msedge.exe 84 PID 1444 wrote to memory of 4256 1444 msedge.exe 85 PID 1444 wrote to memory of 4256 1444 msedge.exe 85 PID 1444 wrote to memory of 4256 1444 msedge.exe 85 PID 1444 wrote to memory of 4256 1444 msedge.exe 85 PID 1444 wrote to memory of 4256 1444 msedge.exe 85 PID 1444 wrote to memory of 4256 1444 msedge.exe 85 PID 1444 wrote to memory of 4256 1444 msedge.exe 85 PID 1444 wrote to memory of 4256 1444 msedge.exe 85 PID 1444 wrote to memory of 4256 1444 msedge.exe 85 PID 1444 wrote to memory of 4256 1444 msedge.exe 85 PID 1444 wrote to memory of 4256 1444 msedge.exe 85 PID 1444 wrote to memory of 4256 1444 msedge.exe 85 PID 1444 wrote to memory of 4256 1444 msedge.exe 85 PID 1444 wrote to memory of 4256 1444 msedge.exe 85 PID 1444 wrote to memory of 4256 1444 msedge.exe 85 PID 1444 wrote to memory of 4256 1444 msedge.exe 85 PID 1444 wrote to memory of 4256 1444 msedge.exe 85 PID 1444 wrote to memory of 4256 1444 msedge.exe 85 PID 1444 wrote to memory of 4256 1444 msedge.exe 85 PID 1444 wrote to memory of 4256 1444 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\10bfecf799b3d682ed88d77409f0bd07_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff540d46f8,0x7fff540d4708,0x7fff540d47182⤵PID:1780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14711252648479531800,1826786789492494081,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,14711252648479531800,1826786789492494081,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,14711252648479531800,1826786789492494081,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:82⤵PID:4256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14711252648479531800,1826786789492494081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:3040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14711252648479531800,1826786789492494081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14711252648479531800,1826786789492494081,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3252
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4552
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
- MD5 9e3fc58a8fb86c93d19e1500b873ef6f
- SHA1 c6aae5f4e26f5570db5e14bba8d5061867a33b56
- SHA512 e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
- MD5 27304926d60324abe74d7a4b571c35ea
- SHA1 78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
- SHA512 f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 4343a8e1aa4bb499db72e4e504f3b042c5b82cf635515fba56b9d8810729cfa1
- MD5 e65e029cf7ac3c6ebaa493932184d616
- SHA1 15949821a4c68cc114ccf2d71c61fb66ffc30352
- SHA512 10dc9c391781ffab5d68c0bda10c924dca253a452e76b4c38bb65e414b6ecb2516a5e0fb7a96e7f320d62f0d7a66a916b32b94b87a4759b7ab53bbc0fe2bc8a2
- SSDEEP 96:njkzTA18VwpvWMoiVmdeH4piNqUWQyV+VDCAiEwb:njkzUqVGWMX4k0rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 4d9de1bc183ad62c164cb756a9fdf0f7fe7525945994647e8ced38f14e3d4004
- MD5 3e8fe345b22cd6c9feebda356f6c4cbd
- SHA1 26d804907f53736aa675ffb9a81504a10b06521f
- SHA512 64c9848aef41fbc68198f1c8dc0faffa787ada5e23a7424022e241d7907a35d6272c5a36a53ae6802480f5fabf2bbcde0c7cefba2e05cd5830c5d19b81c38694
- SSDEEP 96:njkzzA18VwpvWMoiVmdeH4piNqUWQyV+VDCziEwb:njkz0qVGWMX4k0ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 c45adb4aa498032c0bdad20d395fe591f623206cead9885063a9cdce7d37f194
- MD5 17c827ee0a4041507eea81ce45e5f840
- SHA1 689f4cbd6b7cf9567abbcb59ed44fc7d932fe731
- SHA512 dae54f82b7612f0d564ef3fef7060e8113668a1abbc5a7805e180b193b47915cd6cc19ddc42039bde83cc3021f1f84a2e2af03e724f306a639f15635211daf7b
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup4x5e2RULc8ZIcM/bo5Zx7:A9iIxuERzA83h09RZxYytYqqZx7
- MD5 SHA1 SHA512 SSDEEP