Analysis
- max time kernel
145s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
11/12/2024, 23:41
Static task
static1
Behavioral task
behavioral1
Sample
e3b79636493c42f2667c3d48093ea162_JaffaCakes118.html
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
e3b79636493c42f2667c3d48093ea162_JaffaCakes118.html
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target e3b79636493c42f2667c3d48093ea162_JaffaCakes118.html
- Size 36KB
- Sample241211-3psdmaxkhl
- SHA256 b6418dd697a2f8f71243fe27cf684dee21aed24229ef5aa43d8b8c46b1b5ccd0
- MD5 e3b79636493c42f2667c3d48093ea162
- SHA1 c11c1846369f87846e6569106abcdef431e06a65
- SHA512 e21662063df0d4e7a2219009ca04d90d0075657e405931e489e74cf495ad2d70a4e7e22f73fe3797a3623dddc84fb80af1be784ae27789e495bfaad93ff360a4
- SSDEEP 384:Syl+eDxVkKYqaq+GOW2QZhX68SloGhDm6PF3n/VL6BawoKoQcCFx0J69dkc:SylXSKYqUnLaGhS6Pl/UBzR70J69dkc
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4812 msedge.exe 4812 msedge.exe 640 msedge.exe 640 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 640 wrote to memory of 5080 640 msedge.exe 84 PID 640 wrote to memory of 5080 640 msedge.exe 84 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 3148 640 msedge.exe 85 PID 640 wrote to memory of 4812 640 msedge.exe 86 PID 640 wrote to memory of 4812 640 msedge.exe 86 PID 640 wrote to memory of 4876 640 msedge.exe 87 PID 640 wrote to memory of 4876 640 msedge.exe 87 PID 640 wrote to memory of 4876 640 msedge.exe 87 PID 640 wrote to memory of 4876 640 msedge.exe 87 PID 640 wrote to memory of 4876 640 msedge.exe 87 PID 640 wrote to memory of 4876 640 msedge.exe 87 PID 640 wrote to memory of 4876 640 msedge.exe 87 PID 640 wrote to memory of 4876 640 msedge.exe 87 PID 640 wrote to memory of 4876 640 msedge.exe 87 PID 640 wrote to memory of 4876 640 msedge.exe 87 PID 640 wrote to memory of 4876 640 msedge.exe 87 PID 640 wrote to memory of 4876 640 msedge.exe 87 PID 640 wrote to memory of 4876 640 msedge.exe 87 PID 640 wrote to memory of 4876 640 msedge.exe 87 PID 640 wrote to memory of 4876 640 msedge.exe 87 PID 640 wrote to memory of 4876 640 msedge.exe 87 PID 640 wrote to memory of 4876 640 msedge.exe 87 PID 640 wrote to memory of 4876 640 msedge.exe 87 PID 640 wrote to memory of 4876 640 msedge.exe 87 PID 640 wrote to memory of 4876 640 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\e3b79636493c42f2667c3d48093ea162_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff003946f8,0x7fff00394708,0x7fff003947182⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,9108689889189972823,7413029156405610997,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:3148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,9108689889189972823,7413029156405610997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,9108689889189972823,7413029156405610997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9108689889189972823,7413029156405610997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:12⤵PID:3296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9108689889189972823,7413029156405610997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9108689889189972823,7413029156405610997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:12⤵PID:3632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9108689889189972823,7413029156405610997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:12⤵PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,9108689889189972823,7413029156405610997,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5552 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1388
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2560
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
- MD5 d7cb450b1315c63b1d5d89d98ba22da5
- SHA1 694005cd9e1a4c54e0b83d0598a8a0c089df1556
- SHA512 df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
- MD5 37f660dd4b6ddf23bc37f5c823d1c33a
- SHA1 1c35538aa307a3e09d15519df6ace99674ae428b
- SHA512 807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 1KB
- SHA256 999c5e0b4cbcaa1bb38a6fddc4b4da64673157628dfc8facf71846e14e95c363
- MD5 f3a45064d4b6812634e47fc3e346bc81
- SHA1 fcb00d351bb1bc92751388690412263d6226aa76
- SHA512 9470e2e7647985f10fb34ff8123945704056536838e0006c1b3890d2ed7e0e1575bc45a86589d961cd9dbfcb7547577a045eb1557f64e77a50e1eb6150b46bed
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 b7d9c02e90e354e51672b3477afd48c4e3ae596317aed422d6363a9bce9afbc5
- MD5 610b13e38f1b0e19a69c43017b888cf0
- SHA1 c75d294384343d63f79f6fcdd8aea6ea1e7711ff
- SHA512 f2aab8c463b4618d397c9becee8d45e2122870fbcc1716c1f1ace6ad37b4f85269dbdf3c90ee531b2d6b6325813ad66c41f02a2cd124a18b8e2a0e5b3a7a78c3
- SSDEEP 96:nlk5A1rNwpvWMoiVmdeHqZb7TUWQyV+VDCziEwb:nlkiJNGWMXg7Tro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 75aad206dd0fbc952105fb77892edf82f033405fd1a3fe0a846e1c7c6d1b83de
- MD5 acfbfe2a7f24a08c2e3b9cb4eb4e7662
- SHA1 b895fcc19771b5c52e5617a989784092341f1650
- SHA512 851317a74e3eaf88f390c26111197700788c9552f7c14b3991892d94680f56932a8ef5c231ad2906ed0c170043d5f81102fee77198bdc702e197be4aacb08f97
- SSDEEP 96:nlkEA1rFwpvWMoiVmdeZ0NI39C2qZb7TUWQyV+VDCAiEwb:nlkBJFGWMJ0NI39C2g7TrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 c619fd3dcb8ac7e540484084d2b132b94c14ec5f453ae74b938cd0491d56c0ae
- MD5 7734615cb6990e40abea26deb433f900
- SHA1 5fd8999452611e8771dc8943bcbe62ced15ae037
- SHA512 b0fd4a94cd548a9cc0403b0c61f86cb47a514eb4716ad168881dd60a5ff3e1e1db26ee3718e0f1e14193a57f1f80aea2f6feb255f1cd2ccdc7dc9d84fa7af029
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup9jZWWce2RUuemS2YdF980Z:A9iIxuERzA83h09RZxYzWHep2Yi0Y5u
- MD5 SHA1 SHA512 SSDEEP