Analysis
- max time kernel
149s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
04/10/2024, 21:47
Static task
static1
Behavioral task
behavioral1
Sample
1507d29dc4261345d92ad73ad26e06f1_JaffaCakes118.html
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
1507d29dc4261345d92ad73ad26e06f1_JaffaCakes118.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 1507d29dc4261345d92ad73ad26e06f1_JaffaCakes118.html
- Size 227KB
- Sample241004-1njc8aserf
- SHA256 a7321e1b6db33137e7f769f7f564f6a4863ccd97977d2bd7aad71d03dfd282d4
- MD5 1507d29dc4261345d92ad73ad26e06f1
- SHA1 7f1d0bdb02d880c30b629b3014ed4507d1f7b993
- SHA512 b7feae3045472944680beb688b1ac285b92abd5c24d2429e1c0065b9e398159a7f49423d80c96c8f09993bca38c609ddc6b630cccbfe223c94620db6ab225b47
- SSDEEP 3072:SNV1VyfkMY+BES09JXAnyrZalI+YuyfkMY+BES09JXAnyrZalI+YQ:Sv1AsMYod+X3oI+YLsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4812 msedge.exe 4812 msedge.exe 3160 msedge.exe 3160 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3160 msedge.exe 3160 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3160 wrote to memory of 3420 3160 msedge.exe 82 PID 3160 wrote to memory of 3420 3160 msedge.exe 82 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 1880 3160 msedge.exe 83 PID 3160 wrote to memory of 4812 3160 msedge.exe 84 PID 3160 wrote to memory of 4812 3160 msedge.exe 84 PID 3160 wrote to memory of 2388 3160 msedge.exe 85 PID 3160 wrote to memory of 2388 3160 msedge.exe 85 PID 3160 wrote to memory of 2388 3160 msedge.exe 85 PID 3160 wrote to memory of 2388 3160 msedge.exe 85 PID 3160 wrote to memory of 2388 3160 msedge.exe 85 PID 3160 wrote to memory of 2388 3160 msedge.exe 85 PID 3160 wrote to memory of 2388 3160 msedge.exe 85 PID 3160 wrote to memory of 2388 3160 msedge.exe 85 PID 3160 wrote to memory of 2388 3160 msedge.exe 85 PID 3160 wrote to memory of 2388 3160 msedge.exe 85 PID 3160 wrote to memory of 2388 3160 msedge.exe 85 PID 3160 wrote to memory of 2388 3160 msedge.exe 85 PID 3160 wrote to memory of 2388 3160 msedge.exe 85 PID 3160 wrote to memory of 2388 3160 msedge.exe 85 PID 3160 wrote to memory of 2388 3160 msedge.exe 85 PID 3160 wrote to memory of 2388 3160 msedge.exe 85 PID 3160 wrote to memory of 2388 3160 msedge.exe 85 PID 3160 wrote to memory of 2388 3160 msedge.exe 85 PID 3160 wrote to memory of 2388 3160 msedge.exe 85 PID 3160 wrote to memory of 2388 3160 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1507d29dc4261345d92ad73ad26e06f1_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb12246f8,0x7ffdb1224708,0x7ffdb12247182⤵PID:3420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4420536354334199219,5908270713133105226,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:1880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,4420536354334199219,5908270713133105226,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,4420536354334199219,5908270713133105226,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:82⤵PID:2388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4420536354334199219,5908270713133105226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:2524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4420536354334199219,5908270713133105226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:3340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4420536354334199219,5908270713133105226,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 /prefetch:22⤵PID:1112
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2984
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3368
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
- MD5 9b008261dda31857d68792b46af6dd6d
- SHA1 e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
- SHA512 78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
- MD5 0446fcdd21b016db1f468971fb82a488
- SHA1 726b91562bb75f80981f381e3c69d7d832c87c9d
- SHA512 1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 9fc3623b310562b3fa92e6a5d72913bccd17ebdfb1e040d98346ee9c3d5eebf6
- MD5 c653d1e98209a18c9b5db8fe8dcb4074
- SHA1 8c8b5e66ae3ae05c11e764a35f1979798197db37
- SHA512 f776c30a5d7965cbc95b972b6b17b939409887bfb9a22bd5d80f5761daceba95b3d1cd11893234ae17289e0bac2fdc3671039a2c51c71ebc813c3053ba2d4863
- SSDEEP 96:nKkxzrGL1ScdwpvWMoiVmdeH/ddUNUWQyV+VDCziEwb:nKkx3EcqGWMX1eNro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 16022b98987d350d74942b93079d788808933a5271fbaa646bb69ef3d9716d72
- MD5 c8194d6a14e40a8e881b0956cab70af9
- SHA1 bc6dbd8a0dbc2acdebc6101ba5e8e46cc1cdf831
- SHA512 2162ac1ef962828936b40c56ad71cdf6fe17d04e81e32f0964e0ada6efeebce9d1af7be05451e720e1d9680d541c97159ace7be486f7d4b89fa0d65db5e6d6af
- SSDEEP 96:nKkxTrGL1ScdwpvWMoiVmdeH/ddUNUWQyV+VDCAiEwb:nKkxXEcqGWMX1eNrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 122c3e3a32a3c4be251211dd5b455fed567527799db04ea10156d24f10459603
- MD5 798d5fdb70ae55834adff34918b471a4
- SHA1 e64716f916c9551b5b08a75e533328604d6ae9d5
- SHA512 82f062e25406e0748c09e07acbb7bdba56990e75a743e5f41f5db064f828fd3fc1cd40e47f75fec5fa04a91de8123e29ac9671ebc3f4fca33aa2a26cfa3e05fb
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupeE3e2RU9sB2eIGIcM/bo5T:A9iIxuERzA83h09RZxYzQsArvqZx7
- MD5 SHA1 SHA512 SSDEEP