Analysis
- max time kernel
145s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
07/10/2024, 04:12
Static task
static1
Behavioral task
behavioral1
Sample
1b6a68b1004d040754219d17e08267eb_JaffaCakes118.html
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
1b6a68b1004d040754219d17e08267eb_JaffaCakes118.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 1b6a68b1004d040754219d17e08267eb_JaffaCakes118.html
- Size 81KB
- Sample241007-esqgfaveln
- SHA256 adca3eef0b2108d15c10d2be2b7c7db4d9ad269adb8ba2632d9618a58449dc28
- MD5 1b6a68b1004d040754219d17e08267eb
- SHA1 6a767593ed54682213bc641883c46eebcdd87557
- SHA512 f49632c69c590523cd4ba920589208442cf9eba9574323aa78e24088053531d3101817c0b8de35a449e6a78bd5e9ad39bc4e5c4da0fc3dc1712fa66f163ab23d
- SSDEEP 1536:C1x8m/kj1odoh8XZPodohGeBNCutMMQ2Hd:CLM1odoh8XZPodohGeBNCutMMQ2Hd
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4496 msedge.exe 4496 msedge.exe 2632 msedge.exe 2632 msedge.exe 4036 msedge.exe 4036 msedge.exe 4036 msedge.exe 4036 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2632 msedge.exe 2632 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2632 wrote to memory of 3400 2632 msedge.exe 82 PID 2632 wrote to memory of 3400 2632 msedge.exe 82 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 2992 2632 msedge.exe 83 PID 2632 wrote to memory of 4496 2632 msedge.exe 84 PID 2632 wrote to memory of 4496 2632 msedge.exe 84 PID 2632 wrote to memory of 4104 2632 msedge.exe 85 PID 2632 wrote to memory of 4104 2632 msedge.exe 85 PID 2632 wrote to memory of 4104 2632 msedge.exe 85 PID 2632 wrote to memory of 4104 2632 msedge.exe 85 PID 2632 wrote to memory of 4104 2632 msedge.exe 85 PID 2632 wrote to memory of 4104 2632 msedge.exe 85 PID 2632 wrote to memory of 4104 2632 msedge.exe 85 PID 2632 wrote to memory of 4104 2632 msedge.exe 85 PID 2632 wrote to memory of 4104 2632 msedge.exe 85 PID 2632 wrote to memory of 4104 2632 msedge.exe 85 PID 2632 wrote to memory of 4104 2632 msedge.exe 85 PID 2632 wrote to memory of 4104 2632 msedge.exe 85 PID 2632 wrote to memory of 4104 2632 msedge.exe 85 PID 2632 wrote to memory of 4104 2632 msedge.exe 85 PID 2632 wrote to memory of 4104 2632 msedge.exe 85 PID 2632 wrote to memory of 4104 2632 msedge.exe 85 PID 2632 wrote to memory of 4104 2632 msedge.exe 85 PID 2632 wrote to memory of 4104 2632 msedge.exe 85 PID 2632 wrote to memory of 4104 2632 msedge.exe 85 PID 2632 wrote to memory of 4104 2632 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1b6a68b1004d040754219d17e08267eb_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb974046f8,0x7ffb97404708,0x7ffb974047182⤵PID:3400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,13293532189711034759,10612426606477342155,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,13293532189711034759,10612426606477342155,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,13293532189711034759,10612426606477342155,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:4104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13293532189711034759,10612426606477342155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13293532189711034759,10612426606477342155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:4752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,13293532189711034759,10612426606477342155,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4976 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4036
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2180
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
- MD5 53bc70ecb115bdbabe67620c416fe9b3
- SHA1 af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
- SHA512 cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
- MD5 e765f3d75e6b0e4a7119c8b14d47d8da
- SHA1 cc9f7c7826c2e1a129e7d98884926076c3714fc0
- SHA512 a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 972B
- SHA256 bec7e0a4850d362137c80b265fe0bcdd4def1df9a07b8fe8f34e36fe58f44327
- MD5 c02c9e57837579e724aa6732e701dc56
- SHA1 0cb4aa47b319b698bdb72b9950aea4fc48c9f562
- SHA512 7cf78643fc9e4c91b2700f955168a6f78dca2ed2383eacb896dac8d6abe0045d97731ffa1bdd30ae0890667467f5eda028e5435a7a94589a3934246c36e53bde
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 941B
- SHA256 1bc469a01120afa7170f60736b9a3ac4a215ec343eca5e72b6e969d5ed313829
- MD5 56eb7c39f87e7f600d02321a99a3c3e4
- SHA1 777d999f8a32ae4fa606109f90a05ad1d1907429
- SHA512 dd3688b8eaf189d47d0865ce7addee262fbfbf666ebb5c66a4a9607604fa2c37ea687bf1299a1946c0d46853cd87aad216aa270d103e6ccf553cc7162ae3ac6f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 191b5fb45828ccc602244c95ae7882365921e2ccefa194b04138eeb78e53865a
- MD5 0346632c8599110f3bda5428a9c9ab6c
- SHA1 5efa503192892f4376f14d2bcefbf3da3888846f
- SHA512 3a8d79c074aa04ac1e6e554cfb4f2d91082dcd0283cd59e1b040f8fdfac04b5e92175c51c7496c4bf208d35e841cbe605c16496e95950fc2a17e941f801d74bd
- SSDEEP 96:n8kRzW1sFQwpvWMoiVmdeH85qYIs+UWQyV+VDCziEwb:n8kRCSFQGWMXa+ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 7KB
- SHA256 3d4d8843a8f6764914108d5e7a3855c14c87c81c7c4503ab35ea7579308a1e18
- MD5 b311a144253c17352e8af9cfbd67e443
- SHA1 f317add5ca8377acb1a51e41023721d829f41410
- SHA512 00e6d955bc2b7dc87d57bb545f566e74d7a139d598f15811733dd747aa55641306eb95950ef8705a6fc7fb68f718514a414a8eb3eb495815281c8fa316b0f806
- SSDEEP 96:n8kRTW1sKQQwpvWMoiVmdeNz+qVfqfepE8EhLWYv285qYIs+UWQyV+VDCAiEwb:n8kRiSdQGWMdz+qVSfeG8EYYv2a+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 b8b7fe6e6b6dab92a5f049f869d32a16ce000a9337f2348e4b119a86e4fc8aa4
- MD5 b2fd79f21d9c8d35d76615cda3a99f3a
- SHA1 69ea8f1c1874446e138dd7e381c4e7b7236e64cd
- SHA512 75c6c64c77810ca6e24aa3933846f129c84bf286a248a6bbd29da6e2952ce00e7cd2bf432a41d192de4fa54856112897b0720ff56e731c2afe0514474fbbd45a
- SSDEEP 96:n8kRTW1sFQwpvWMoiVmdeNz+qVfqfew285qYIs+UWQyV+VDCAiEwb:n8kRiSFQGWMdz+qVSfew2a+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 e01688db81c09efc7ac96a20ea2f4e9a47ff99db0b692b2562502807bf56075c
- MD5 dd56b1d45d02f54c1d5e8e887b5c30ed
- SHA1 5e1f2ec9094ab228afab36be35c722f188327ac5
- SHA512 0013f3f6c868a930e4c90d9c6d6c7fbb76481746fc7f3dd6b8cbd763e833034e1c3c3c1f43579fa04d3b9ca9372f021e0b38788b26de53f2042011e9ab84687e
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfRclQae2RUpp/7i+qIcM/J:A9iIxuERzA83h09RZxYpoPiTVDqZxu
- MD5 SHA1 SHA512 SSDEEP