Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
18/10/2024, 03:21
Static task
static1
Behavioral task
behavioral1
Sample
553448e6f345f08a3cda0790ded07c46_JaffaCakes118.html
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
553448e6f345f08a3cda0790ded07c46_JaffaCakes118.html
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 553448e6f345f08a3cda0790ded07c46_JaffaCakes118.html
- Size 214KB
- Sample241018-dwdrdaxcjq
- SHA256 b73016301d37e2142d3c961de1e89ff2dee61664cafbf63fdfee8769b2eaa53e
- MD5 553448e6f345f08a3cda0790ded07c46
- SHA1 17a8e4b2e17051efd2bb3b2b7ec6c3db9766e9af
- SHA512 da146ddf252c3ae516e832f0bfd4dbc72124417093a14d86915494a660f8e36fbc8bb0fdc4ac758cea94a796c0a945af7af042036cfb915c35c962343ee2a7b0
- SSDEEP 3072:ArhB9CyHxX7Be7iAvtLPbAwuBNKifXTJg:Yz9VxLY7iAVLTBQJlg
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 908 msedge.exe 908 msedge.exe 3684 msedge.exe 3684 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3684 msedge.exe 3684 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe 3684 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3684 wrote to memory of 1644 3684 msedge.exe 84 PID 3684 wrote to memory of 1644 3684 msedge.exe 84 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 5076 3684 msedge.exe 85 PID 3684 wrote to memory of 908 3684 msedge.exe 86 PID 3684 wrote to memory of 908 3684 msedge.exe 86 PID 3684 wrote to memory of 1104 3684 msedge.exe 87 PID 3684 wrote to memory of 1104 3684 msedge.exe 87 PID 3684 wrote to memory of 1104 3684 msedge.exe 87 PID 3684 wrote to memory of 1104 3684 msedge.exe 87 PID 3684 wrote to memory of 1104 3684 msedge.exe 87 PID 3684 wrote to memory of 1104 3684 msedge.exe 87 PID 3684 wrote to memory of 1104 3684 msedge.exe 87 PID 3684 wrote to memory of 1104 3684 msedge.exe 87 PID 3684 wrote to memory of 1104 3684 msedge.exe 87 PID 3684 wrote to memory of 1104 3684 msedge.exe 87 PID 3684 wrote to memory of 1104 3684 msedge.exe 87 PID 3684 wrote to memory of 1104 3684 msedge.exe 87 PID 3684 wrote to memory of 1104 3684 msedge.exe 87 PID 3684 wrote to memory of 1104 3684 msedge.exe 87 PID 3684 wrote to memory of 1104 3684 msedge.exe 87 PID 3684 wrote to memory of 1104 3684 msedge.exe 87 PID 3684 wrote to memory of 1104 3684 msedge.exe 87 PID 3684 wrote to memory of 1104 3684 msedge.exe 87 PID 3684 wrote to memory of 1104 3684 msedge.exe 87 PID 3684 wrote to memory of 1104 3684 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\553448e6f345f08a3cda0790ded07c46_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcf1746f8,0x7ffdcf174708,0x7ffdcf1747182⤵PID:1644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,10000121319142686239,1603960872581809577,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,10000121319142686239,1603960872581809577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,10000121319142686239,1603960872581809577,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:82⤵PID:1104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10000121319142686239,1603960872581809577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10000121319142686239,1603960872581809577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,10000121319142686239,1603960872581809577,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3124
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2312
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4488
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
- MD5 fab8d8d865e33fe195732aa7dcb91c30
- SHA1 2637e832f38acc70af3e511f5eba80fbd7461f2c
- SHA512 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
- MD5 36988ca14952e1848e81a959880ea217
- SHA1 a0482ef725657760502c2d1a5abe0bb37aebaadb
- SHA512 d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 4deef0bbb5afac0868122ff29c3dd0e9efe5c2b0048ce87d2e2437e568a10021
- MD5 7ce007c5c324e8367c67810382789633
- SHA1 7abf30f050bd11005ca32219262a3d0927cf7e5c
- SHA512 7657d112fe643e6c2ab2000430d72645bfbbf39173a2fb2147b849188c71a3751ebc7d1b6e1f80286494c14b2f1af0998d4c51f0928260e8270b9fbe03c3b617
- SSDEEP 96:nPk+S19aSwpvWMoiVmdeHBjsHX6UWQyV+VDCziEwb:nPkNTBGWMXBQX6ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 3fe02397e5122d148aa0f928b245d21756e765939caf6de4aae053a6dadcbaa9
- MD5 0e5ff294d05c7999cb85dc963b419b87
- SHA1 761828ad8f24c336132b167daced57c5129d9482
- SHA512 7b602b999493f0d50149281ea12ba8f379b085348bbc02515e452e613af29c2fda1442361d99a3eb686a624b639c29b5e68b0cb2dbf5fb70cc19321e4bc002a4
- SSDEEP 96:nPkwS19aSwpvWMoiVmdedqBjsHX6UWQyV+VDCAiEwb:nPkDTBGWMtqBQX6rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 9ae8559fd841a371c422c913eb0e5db7660e09cc343db82f4a6dcac6c7b32081
- MD5 9ae4ef4cbf1113f64832a82b85d7739e
- SHA1 6e69af2ba3d64fe5cdff0920b3e6aa0e248aa8c4
- SHA512 0a20ddd6cdd2f9c20fc530be53077f45ce71ff6d27b0ba7921d693076ca84c347642a463009fd208514a029632c25b20835f26886b05ca308393f92624b5023e
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupie2RUj/ch/1K3wOyhu:A9iIxuERzA83h09RZxYceINKohu
- MD5 SHA1 SHA512 SSDEEP