Overview
overview
10Static
static
3b7938b29a7...18.exe
windows7-x64
10b7938b29a7...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3152605369.html
windows7-x64
3152605369.html
windows10-2004-x64
31916524053.html
windows7-x64
31916524053.html
windows10-2004-x64
33072838935.html
windows7-x64
33072838935.html
windows10-2004-x64
332093631739.html
windows7-x64
332093631739.html
windows10-2004-x64
3910218026.html
windows7-x64
3910218026.html
windows10-2004-x64
3SuggestBox.js
windows7-x64
3SuggestBox.js
windows10-2004-x64
3Uninstaller.exe
windows7-x64
Uninstaller.exe
windows10-2004-x64
ads-the-in...d.html
windows7-x64
3ads-the-in...d.html
windows10-2004-x64
3locales308946821.html
windows7-x64
3locales308946821.html
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2024 07:49
Static task
static1
Behavioral task
behavioral1
Sample
b7938b29a73c948e483937740e10f679_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
b7938b29a73c948e483937740e10f679_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
152605369.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
152605369.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
1916524053.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
1916524053.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
3072838935.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
3072838935.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
32093631739.html
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral12
Sample
32093631739.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
910218026.html
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral14
Sample
910218026.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
SuggestBox.js
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral16
Sample
SuggestBox.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Uninstaller.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
Uninstaller.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
ads-the-internet-the-icon-revealed.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
ads-the-internet-the-icon-revealed.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
locales308946821.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
locales308946821.html
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
910218026.html
-
Size
14KB
-
MD5
e1754cf777eeedcc40ccbc8b35a71a97
-
SHA1
03bf43e5f643856c3ce6f8508f28cb7bad87deff
-
SHA256
250ceae9d074a576a7be1607ebb08ab71a4a135676ff72432171c9ef11a8b5a2
-
SHA512
30c8589b2efa04a89f4e57897be997d374dd9470b85633c4f9cdbe5b80055d6db08b2ec7318f1881c6b039c8620ec96314e24ae2251913a5907186be8811041e
-
SSDEEP
384:0WUkF9oPJMk2rvaAuzS16ofM+1PyHLDUqPz58e+InvkubE2:lmydcgOR
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1664 msedge.exe 1664 msedge.exe 4084 msedge.exe 4084 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4084 msedge.exe 4084 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4084 wrote to memory of 1448 4084 msedge.exe 83 PID 4084 wrote to memory of 1448 4084 msedge.exe 83 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 3168 4084 msedge.exe 84 PID 4084 wrote to memory of 1664 4084 msedge.exe 85 PID 4084 wrote to memory of 1664 4084 msedge.exe 85 PID 4084 wrote to memory of 2036 4084 msedge.exe 86 PID 4084 wrote to memory of 2036 4084 msedge.exe 86 PID 4084 wrote to memory of 2036 4084 msedge.exe 86 PID 4084 wrote to memory of 2036 4084 msedge.exe 86 PID 4084 wrote to memory of 2036 4084 msedge.exe 86 PID 4084 wrote to memory of 2036 4084 msedge.exe 86 PID 4084 wrote to memory of 2036 4084 msedge.exe 86 PID 4084 wrote to memory of 2036 4084 msedge.exe 86 PID 4084 wrote to memory of 2036 4084 msedge.exe 86 PID 4084 wrote to memory of 2036 4084 msedge.exe 86 PID 4084 wrote to memory of 2036 4084 msedge.exe 86 PID 4084 wrote to memory of 2036 4084 msedge.exe 86 PID 4084 wrote to memory of 2036 4084 msedge.exe 86 PID 4084 wrote to memory of 2036 4084 msedge.exe 86 PID 4084 wrote to memory of 2036 4084 msedge.exe 86 PID 4084 wrote to memory of 2036 4084 msedge.exe 86 PID 4084 wrote to memory of 2036 4084 msedge.exe 86 PID 4084 wrote to memory of 2036 4084 msedge.exe 86 PID 4084 wrote to memory of 2036 4084 msedge.exe 86 PID 4084 wrote to memory of 2036 4084 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\910218026.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcf3146f8,0x7ffdcf314708,0x7ffdcf3147182⤵PID:1448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,11112140951660262290,230387237731966024,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:3168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,11112140951660262290,230387237731966024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,11112140951660262290,230387237731966024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:82⤵PID:2036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11112140951660262290,230387237731966024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11112140951660262290,230387237731966024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:2124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,11112140951660262290,230387237731966024,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4932 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1112
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2280
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD50a9dc42e4013fc47438e96d24beb8eff
SHA1806ab26d7eae031a58484188a7eb1adab06457fc
SHA25658d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
-
Filesize
152B
MD561cef8e38cd95bf003f5fdd1dc37dae1
SHA111f2f79ecb349344c143eea9a0fed41891a3467f
SHA256ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA5126fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
-
Filesize
5KB
MD5bfadebef57a6a77907e1d9031cfb36ab
SHA12114d21bb249d288808276bd674209e2cc6d6fd6
SHA25662a23e909e23ea9d78f54607145ac416a03d289e9571f87ea8408c7c8b3c081f
SHA512e7f05ce7e29d17aa3019d794ce2b3fa2eeaabf9f4b1499c9c6f92f26ddf84050e7b14898815b81aad9ce141292745310fe5e4b75b54b9d0aa330e735c1cc2c0c
-
Filesize
6KB
MD5869a7a90fdba547475dc684f0498122d
SHA1c317e92e29422c2c8617ca005bb239fe46956ae6
SHA256b78bb975d0c8e49a3ca3f46e65fc77402ce3ac5aa29d8d4d52f9bc17398165df
SHA51272a323582b40f0faf4b57864771f44770bdab8b4e63a170d948c4d68c526ac33c19fdfef0bf8e3a123b8b1ccf8c88a38c866268601038e4e0d0807ebe96ee84d
-
Filesize
10KB
MD58d04b70ac1f1c05b024b1471e0103544
SHA19c0067cb4189b49f2c8b6339e473c181f33ddaae
SHA256ae8929c0bb583a19ed60ce3e4aaf18f8545d796e353c5e2b25b50b7e94562023
SHA5121f7fe1a13613a92448f4fd01a84a15ee2893b2cde1d50a072d048d149de7caffe824bec9c160600f55e8a74828522c05204a3e247f67f3c43643f3dead278bea