Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
18/10/2024, 00:03
Static task
static1
Behavioral task
behavioral1
Sample
545da38ea5a1578e70d54d566be49da9_JaffaCakes118.html
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
545da38ea5a1578e70d54d566be49da9_JaffaCakes118.html
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 545da38ea5a1578e70d54d566be49da9_JaffaCakes118.html
- Size 138KB
- Sample241018-ab7l6stgnb
- SHA256 037e080f866760a4f643e311e73c36a71b92a999bef4f9ff1a09096913291592
- MD5 545da38ea5a1578e70d54d566be49da9
- SHA1 d1f136684f46501ccca01736cccf5e021298a96d
- SHA512 710f6864cfb99345a86108871e72961dd56cc653c043576cca17f587cd80ebb6426876ed6109e4bd2a073e941c33185490fe0acb91fb18ff2af36b97fa3b0b99
- SSDEEP 1536:SZ3T8qYOf8VNG79r5nKVlHLYvyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1Ul:SZjyzYvyfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4052 msedge.exe 4052 msedge.exe 2028 msedge.exe 2028 msedge.exe 5096 msedge.exe 5096 msedge.exe 5096 msedge.exe 5096 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2028 msedge.exe 2028 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2028 wrote to memory of 3216 2028 msedge.exe 84 PID 2028 wrote to memory of 3216 2028 msedge.exe 84 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 2820 2028 msedge.exe 85 PID 2028 wrote to memory of 4052 2028 msedge.exe 86 PID 2028 wrote to memory of 4052 2028 msedge.exe 86 PID 2028 wrote to memory of 2512 2028 msedge.exe 87 PID 2028 wrote to memory of 2512 2028 msedge.exe 87 PID 2028 wrote to memory of 2512 2028 msedge.exe 87 PID 2028 wrote to memory of 2512 2028 msedge.exe 87 PID 2028 wrote to memory of 2512 2028 msedge.exe 87 PID 2028 wrote to memory of 2512 2028 msedge.exe 87 PID 2028 wrote to memory of 2512 2028 msedge.exe 87 PID 2028 wrote to memory of 2512 2028 msedge.exe 87 PID 2028 wrote to memory of 2512 2028 msedge.exe 87 PID 2028 wrote to memory of 2512 2028 msedge.exe 87 PID 2028 wrote to memory of 2512 2028 msedge.exe 87 PID 2028 wrote to memory of 2512 2028 msedge.exe 87 PID 2028 wrote to memory of 2512 2028 msedge.exe 87 PID 2028 wrote to memory of 2512 2028 msedge.exe 87 PID 2028 wrote to memory of 2512 2028 msedge.exe 87 PID 2028 wrote to memory of 2512 2028 msedge.exe 87 PID 2028 wrote to memory of 2512 2028 msedge.exe 87 PID 2028 wrote to memory of 2512 2028 msedge.exe 87 PID 2028 wrote to memory of 2512 2028 msedge.exe 87 PID 2028 wrote to memory of 2512 2028 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\545da38ea5a1578e70d54d566be49da9_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa302e46f8,0x7ffa302e4708,0x7ffa302e47182⤵PID:3216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,14492973186281327306,1365991147789655042,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:22⤵PID:2820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,14492973186281327306,1365991147789655042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,14492973186281327306,1365991147789655042,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:82⤵PID:2512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14492973186281327306,1365991147789655042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14492973186281327306,1365991147789655042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,14492973186281327306,1365991147789655042,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5096
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4024
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
- MD5 99afa4934d1e3c56bbce114b356e8a99
- SHA1 3f0e7a1a28d9d9c06b6663df5d83a65c84d52581
- SHA512 76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
- MD5 443a627d539ca4eab732bad0cbe7332b
- SHA1 86b18b906a1acd2a22f4b2c78ac3564c394a9569
- SHA512 923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 64da59a749458ed7c0dccc87583640962e6cad513e36b9accd36d8fc5ab314ac
- MD5 d115d3dc5d735a0e6fc06cad0950dddb
- SHA1 7e804c2da1abbcd0409e9f96e7c4f3c23045ded9
- SHA512 501cf668cc5737ad18c371413ea8d95acef451d45b67efdeeefdf629994d4a6249d7a401b3c2ec2ec3f97956be0fb21b39c5a6d9addb0d5fd1ed5ba44c949b8a
- SSDEEP 96:nLk++1AxWI/wpvWMoiVmdeHtuEH+UWQyV+VDCziEwb:nLktqxT/GWMXh+ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 af58ce4b1e67d44e02b16ec2e9b0379579c4cf296096bd85c1762f8bfb359140
- MD5 3ba57be4b783e651cd2bbfff4f83d551
- SHA1 ab592e8c13fd84eca1f1d0d3d8bcd71f43ae9ef9
- SHA512 947c889e08975103dc2cce9cea17b7eed8be0a0da2a41a524d2064ae9866656fc4c2e43690d4d08ae4cc7d8a34de09f50bf1c38a841e9eb2d573d57410bcbe1c
- SSDEEP 96:nLkw+1A0WI/wpvWMoiVmdeHtuEH+UWQyV+VDCAiEwb:nLkrq0T/GWMXh+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 e02bafb801c1092bceadfaecbfa4201c446fcda6016afcb1e0543ac50556054c
- MD5 1fbe3cf06bcf633fdc84b1b94ae72d3e
- SHA1 5761cf8328f784a9a803a168e8811559a14c6780
- SHA512 dcc812c8d96544e08d3546fb588d3d01f1fab3efbd073d3b406487acc965a160c4c94cc47a7d256c4cdecdaa93013799848f47108a845af44316cdace2f4ee82
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupYpe2RUvobN1K3wm1sSu:A9iIxuERzA83h09RZxY8LfKTsSu
- MD5 SHA1 SHA512 SSDEEP