Analysis
- max time kernel
145s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
02/12/2024, 14:02
Static task
static1
Behavioral task
behavioral1
Sample
b88eb53c4acbfb5a799e7d1cffba1498_JaffaCakes118.html
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
b88eb53c4acbfb5a799e7d1cffba1498_JaffaCakes118.html
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target b88eb53c4acbfb5a799e7d1cffba1498_JaffaCakes118.html
- Size 132KB
- Sample241202-rb8ynsslbn
- SHA256 be0c297be9df1e96e9d18f4c94b4e809f7295d4ba2c92dc2f49260a431268fa4
- MD5 b88eb53c4acbfb5a799e7d1cffba1498
- SHA1 ed36d8dfe49e3a209f6b92fc8a5303ed2a2deaae
- SHA512 076181a39c73f3b6abcdd0274f2505b96d7a701771bc7417bd8a1c8c3997bfa40fd333d21eff0a80dce4ad37cf3f043cfa8e0c11bc863744ce1e46b82df51dd9
- SSDEEP 1536:bKJEEJXFEEZCjanDD9BVZfkjnJKlf5wrw+iO:bQJX6EZCjanfVZfcj
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2444 msedge.exe 2444 msedge.exe 1968 msedge.exe 1968 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1968 msedge.exe 1968 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 1608 1968 msedge.exe 82 PID 1968 wrote to memory of 1608 1968 msedge.exe 82 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 1420 1968 msedge.exe 83 PID 1968 wrote to memory of 2444 1968 msedge.exe 84 PID 1968 wrote to memory of 2444 1968 msedge.exe 84 PID 1968 wrote to memory of 736 1968 msedge.exe 85 PID 1968 wrote to memory of 736 1968 msedge.exe 85 PID 1968 wrote to memory of 736 1968 msedge.exe 85 PID 1968 wrote to memory of 736 1968 msedge.exe 85 PID 1968 wrote to memory of 736 1968 msedge.exe 85 PID 1968 wrote to memory of 736 1968 msedge.exe 85 PID 1968 wrote to memory of 736 1968 msedge.exe 85 PID 1968 wrote to memory of 736 1968 msedge.exe 85 PID 1968 wrote to memory of 736 1968 msedge.exe 85 PID 1968 wrote to memory of 736 1968 msedge.exe 85 PID 1968 wrote to memory of 736 1968 msedge.exe 85 PID 1968 wrote to memory of 736 1968 msedge.exe 85 PID 1968 wrote to memory of 736 1968 msedge.exe 85 PID 1968 wrote to memory of 736 1968 msedge.exe 85 PID 1968 wrote to memory of 736 1968 msedge.exe 85 PID 1968 wrote to memory of 736 1968 msedge.exe 85 PID 1968 wrote to memory of 736 1968 msedge.exe 85 PID 1968 wrote to memory of 736 1968 msedge.exe 85 PID 1968 wrote to memory of 736 1968 msedge.exe 85 PID 1968 wrote to memory of 736 1968 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\b88eb53c4acbfb5a799e7d1cffba1498_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba9dc46f8,0x7ffba9dc4708,0x7ffba9dc47182⤵PID:1608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16707726797010055920,1646938618290889650,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:1420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,16707726797010055920,1646938618290889650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,16707726797010055920,1646938618290889650,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:82⤵PID:736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16707726797010055920,1646938618290889650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:12⤵PID:1152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16707726797010055920,1646938618290889650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:1788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16707726797010055920,1646938618290889650,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2752 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4460
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4324
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
- Size 328B
- SHA256 b4a9bdc206fd93ebd7fd671356ea4cbc923263f95849e305ed213cde5575797d
- MD5 9a09413f0ad475aca69c2541843229f7
- SHA1 737532f6fd24ac285d7c4bfa4009c3a39fa7eb53
- SHA512 616dd96f661fb086b6d45903b8d707fbf79413f5708d2da4fab3835728a8596fcc6077f7827cd748ee4ad60c90582c229671813335bf8495eb38f5281e117dc0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
- MD5 fab8d8d865e33fe195732aa7dcb91c30
- SHA1 2637e832f38acc70af3e511f5eba80fbd7461f2c
- SHA512 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
- MD5 36988ca14952e1848e81a959880ea217
- SHA1 a0482ef725657760502c2d1a5abe0bb37aebaadb
- SHA512 d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 1KB
- SHA256 63771422ff3a7aba8a8818098a24f6ab1e4b5dd6ea0f00f8f8985954675ea496
- MD5 87b888c2a24587321afcbfabd971f604
- SHA1 d1468f3b118921c682835580c437e15bdd4edc92
- SHA512 14b3309cd047deeded82f95d2c0f65021571de744116db12f0ae6e488d6c908e6ce3a2d8e2e0fa6d535ebc1546ada36a9dbed1d9eb58bdac680c5e5b02d0e9dc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 af85380765cf9015d264ea5f5bffba1501d7f932b72f0bfbcc13b8d15f71ddfe
- MD5 d73ac69e68dcd78aa8ae599c94d81af3
- SHA1 f80996744ed9b160a12b441c6da1060d97849aa4
- SHA512 f03d4c072106abf7974ab36326d851e192f3fcd77128c3078a585eb582741fc5d4020e01d66ec263da1a429cca68043da57bd2e11ab55f8f981d4acf88d820b5
- SSDEEP 96:nCOkrSLB1FmSwpvWMoiVmdeHBjs79boUWQyV+VDCziEwb:n1kABLtGWMXB/ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 9122a8b9b86a6c67ca5f8e3355782ddd363858c61616049d86e3fcfb9b18a3db
- MD5 41d28f53e889f05c7deee49061ff6ad4
- SHA1 3019a03225e2699db7f55ba9e3e6812558b63672
- SHA512 d10ab14d9034f7ff623146a4b9daeb6ddb03085114e800793337250531b0c9b10cc20ea33146af3226c43bcaced85f3844d3bbb95f1f7718da72640bd09cb70e
- SSDEEP 96:nCOkLSLB1FmSwpvWMoiVmdeR7Keq8NuQVTSUTlupx2Bjs79boUWQyV+VDCAiEwb:n1kgBLtGWMQenNv8WID2B/rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 11469667ae97ccebda56e934be62b285e0738fa9b688161caffbe8e63980929f
- MD5 ae84a68ba38ecc8f94e71d75da9f5567
- SHA1 033d76ecdbfbb0decdaa060bd96af73b67186351
- SHA512 dd0fc17f25813b220aa1663c0b1ec3ab478005b56966e5bcab18e6d70c08b3c0c8d651bd8e976380c1637959ea75ffe9e50c09f6df37fe0b2e295dbf3b143dc1
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupP2e2RUkhhN/YdF980JQwUc:A9iIxuERzA83h09RZxYwVN/Yi0Yxu
- MD5 SHA1 SHA512 SSDEEP