d2bffbcda585071b148d1860a40032c11d62432084eefa2460873edf92b41957

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
072d316d5def157430a171cd5ebf3dff_JaffaCakes118.html
Size 158KB
Sample240429-jsn1tsdh24
SHA256 d2bffbcda585071b148d1860a40032c11d62432084eefa2460873edf92b41957
MD5 072d316d5def157430a171cd5ebf3dff
SHA1 60a18fe9b32bc861794c0c2e9699dc82d40b75a4
SHA512 6552f951f68e5b0ffb6f30a6a48860072fc370d05b0ba12197d1450435be15caf83b88b7ca68adcbd2d3cc1fa2f5345bad2b6f0d6e41b1809e235f774b56147e
SSDEEP 1536:inRT/ZZaaTM3HyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:iJEHyfkMY+BES09JXAnyrZalI+YQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4800	msedge.exe
4800	msedge.exe
4380	identity_helper.exe
4380	identity_helper.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 1868	4800	msedge.exe	85
PID 4800 wrote to memory of 1868	4800	msedge.exe	85
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4796	4800	msedge.exe	86
PID 4800 wrote to memory of 4784	4800	msedge.exe	87
PID 4800 wrote to memory of 4784	4800	msedge.exe	87
PID 4800 wrote to memory of 2448	4800	msedge.exe	88
PID 4800 wrote to memory of 2448	4800	msedge.exe	88
PID 4800 wrote to memory of 2448	4800	msedge.exe	88
PID 4800 wrote to memory of 2448	4800	msedge.exe	88
PID 4800 wrote to memory of 2448	4800	msedge.exe	88
PID 4800 wrote to memory of 2448	4800	msedge.exe	88
PID 4800 wrote to memory of 2448	4800	msedge.exe	88
PID 4800 wrote to memory of 2448	4800	msedge.exe	88
PID 4800 wrote to memory of 2448	4800	msedge.exe	88
PID 4800 wrote to memory of 2448	4800	msedge.exe	88
PID 4800 wrote to memory of 2448	4800	msedge.exe	88
PID 4800 wrote to memory of 2448	4800	msedge.exe	88
PID 4800 wrote to memory of 2448	4800	msedge.exe	88
PID 4800 wrote to memory of 2448	4800	msedge.exe	88
PID 4800 wrote to memory of 2448	4800	msedge.exe	88
PID 4800 wrote to memory of 2448	4800	msedge.exe	88
PID 4800 wrote to memory of 2448	4800	msedge.exe	88
PID 4800 wrote to memory of 2448	4800	msedge.exe	88
PID 4800 wrote to memory of 2448	4800	msedge.exe	88
PID 4800 wrote to memory of 2448	4800	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\072d316d5def157430a171cd5ebf3dff_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fde846f8,0x7ff9fde84708,0x7ff9fde84718
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,10356134158451892989,7800130117443959729,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,10356134158451892989,7800130117443959729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,10356134158451892989,7800130117443959729,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2424 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10356134158451892989,7800130117443959729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10356134158451892989,7800130117443959729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,10356134158451892989,7800130117443959729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,10356134158451892989,7800130117443959729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10356134158451892989,7800130117443959729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10356134158451892989,7800130117443959729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10356134158451892989,7800130117443959729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10356134158451892989,7800130117443959729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,10356134158451892989,7800130117443959729,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562
MD5 dbac49e66219979194c79f1cf1cb3dd1
SHA1 4ef87804a04d51ae1fac358f92382548b27f62f2
SHA512 bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452
MD5 a9e55f5864d6e2afd2fd84e25a3bc228
SHA1 a5efcff9e3df6252c7fe8535d505235f82aab276
SHA512 12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9135514a5b0aa69599f05ce43c405131ae20a1de10160897b129506117c33fc0
MD5 b847ab51e140da88095a5a9b52b23066
SHA1 c1ebb3fa1a641a353af0d1fd8ef8c414eb56fc50
SHA512 326730466604df3a9b06b980473d9140d018e9489f0639f60565a34f44a215aecdcbe55658d3e2dc97d7c81b5206c882caa86f639d92713094533202d2f12f83
SSDEEP 96:nFk/xm/DQYmq01ZJaf/hXwpvWMoiVmdeHZqJUWQyV+VDCziEwb:nFk0ITjJaHhXGWMXsro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 764d3d5fbe6e9d210ef14a3d0850f6cd1ca67c56a06a274314dd2e032e356f80
MD5 96f11301766cf94ad325e1c8c99675f3
SHA1 65f65d19fd87e7017344b1d520dd0606952377de
SHA512 b4815fd9ed1a546d7cb8844b859f0ed8fe1833a16d9c5e40d860f4e4818e97d69e3ed0793aaa87c5437f15ef793a21a0c36a13055c608f06c73efc56c7c0f32f
SSDEEP 96:nFk/xm/DQYmq01ZJaw/hXwpvWMoiVmdeHZqJUWQyV+VDCAiEwb:nFk0ITjJauhXGWMXsrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4883ea49fe010c98643858cebc91c6b98623b97b2bf27b19a1fe71b5083e039e
MD5 e48563a589a4ba1ce81d90507bc4409b
SHA1 5a14e16c0787b71983711656c39e6b5eb5941b07
SHA512 5c404d5f7624b22b7ea3d4f8c7f76909309c7de66ea45035fa5223a8f037acb7f61b1c1849e8226be2e666dde5beaf8c45960269f4077f115b8ce659eac2b11c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupGYGe2RUUwqGhj:A9iIxuERzA83h09RZxYGjIhj
MD5 SHA1 SHA512 SSDEEP

Submit Download