d61ba62d77821a689ed2b6976f8f1245040aec21ed52cd2ab69a7241992c37df

Analysis

max time kernel
139s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
08a0b256c184f9a9835c148e6adb0d17_JaffaCakes118.html
Size 159KB
Sample240430-a2zz1sfb39
SHA256 d61ba62d77821a689ed2b6976f8f1245040aec21ed52cd2ab69a7241992c37df
MD5 08a0b256c184f9a9835c148e6adb0d17
SHA1 15c1e45ff3cb58aac517dfc5822f7316003d35a4
SHA512 5a6233fb453ca5e904a3dba9220852bbbc23723b8d03ec4d3f995e293da96c72ccf0da81164fa46cafac4b7e8a70a1aeaec10f58e0af1487a4b3114ae42fbe25
SSDEEP 3072:iIpIlG1ryyfkMY+BES09JXAnyrZalI+YQ:i+Mur3sMYod+X3oI+YQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4356	msedge.exe
4356	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
4060	identity_helper.exe
4060	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 3588	4356	msedge.exe	82
PID 4356 wrote to memory of 3588	4356	msedge.exe	82
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 1040	4356	msedge.exe	83
PID 4356 wrote to memory of 4080	4356	msedge.exe	84
PID 4356 wrote to memory of 4080	4356	msedge.exe	84
PID 4356 wrote to memory of 868	4356	msedge.exe	85
PID 4356 wrote to memory of 868	4356	msedge.exe	85
PID 4356 wrote to memory of 868	4356	msedge.exe	85
PID 4356 wrote to memory of 868	4356	msedge.exe	85
PID 4356 wrote to memory of 868	4356	msedge.exe	85
PID 4356 wrote to memory of 868	4356	msedge.exe	85
PID 4356 wrote to memory of 868	4356	msedge.exe	85
PID 4356 wrote to memory of 868	4356	msedge.exe	85
PID 4356 wrote to memory of 868	4356	msedge.exe	85
PID 4356 wrote to memory of 868	4356	msedge.exe	85
PID 4356 wrote to memory of 868	4356	msedge.exe	85
PID 4356 wrote to memory of 868	4356	msedge.exe	85
PID 4356 wrote to memory of 868	4356	msedge.exe	85
PID 4356 wrote to memory of 868	4356	msedge.exe	85
PID 4356 wrote to memory of 868	4356	msedge.exe	85
PID 4356 wrote to memory of 868	4356	msedge.exe	85
PID 4356 wrote to memory of 868	4356	msedge.exe	85
PID 4356 wrote to memory of 868	4356	msedge.exe	85
PID 4356 wrote to memory of 868	4356	msedge.exe	85
PID 4356 wrote to memory of 868	4356	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\08a0b256c184f9a9835c148e6adb0d17_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a53c46f8,0x7ff9a53c4708,0x7ff9a53c4718
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,4640372814341107175,6165831007272552540,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,4640372814341107175,6165831007272552540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,4640372814341107175,6165831007272552540,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4640372814341107175,6165831007272552540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4640372814341107175,6165831007272552540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,4640372814341107175,6165831007272552540,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,4640372814341107175,6165831007272552540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,4640372814341107175,6165831007272552540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4640372814341107175,6165831007272552540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4640372814341107175,6165831007272552540,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4640372814341107175,6165831007272552540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4640372814341107175,6165831007272552540,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 506ab51ff9c4c3aa40a40ae54df83d2a3b7810ebb1d9d4afd423322004cdbce2
MD5 669e39aca68bfb572b877aaae7de0615
SHA1 b65103e21110281880808ca2e4c818787ebeba70
SHA512 dc67ea4924310a08ebf52a9c676da1553de9e60d592d879e7ce2eabb69e7b5d6be043e8f5fc2b0b03d95787f39296a3a9190aff7dc76fd5c7b05374b771193ce
SSDEEP 96:nnfk6Qp1PL3wpvWMoiVmdeHplwthacSUWQyV+VDCziEwb:nfkrtzGWMXpEXSro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9d2c256f149b6cb8fea5fd1d07f15a070ca6e2deb5b9ead0159124530d678bb7
MD5 0d513bc528d4e16991a061da7d04ec0b
SHA1 5009a697d5f377c3e1d52aea22fa26fc117b62ef
SHA512 8a9c164ed8ead0dca5056b2fd573534d126b82f72c8c74df48a446cdab3f0fc1bb14cda9ba1934707b2c1d73a94cf5d4276ca064bc948d675681b88e5e5321af
SSDEEP 96:nnfk+Qp1PO3wpvWMoiVmdeHplwthacSUWQyV+VDCAiEwb:nfkPtOGWMXpEXSrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1543090e498dab64fba64f6a836248197d4e3857872ef7d8b807aaa365eff379
MD5 0c6ba73a9fc0debae0a619c622f049fb
SHA1 d6cf94256ba3cabf916c6faa3c82b17afde658be
SHA512 bce841f6bf3fe0d9914492b1703ef7fa7c8d55122fe3d645ef879c498ac45f41d9ca2ba2e7392d3a23c6276fb00e5cbb436fe4bd41336ab79ae24558b6908dd2
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupeue2RUw12Zjpo88dylluDn:A9iIxuERzA83h09RZxYXV8jpo8aPkM
MD5 SHA1 SHA512 SSDEEP

Submit Download