037fae9606322b9c1409ceb79942b4b1ebcaa9d238c601d9bbd0e4d22bc5e3fd

Analysis

max time kernel
139s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0cf97ac881782d662f4f1e6f85c18af5_JaffaCakes118.html
Size 157KB
Sample240502-arrkwsdf55
SHA256 037fae9606322b9c1409ceb79942b4b1ebcaa9d238c601d9bbd0e4d22bc5e3fd
MD5 0cf97ac881782d662f4f1e6f85c18af5
SHA1 8c2239217c52a0fcfe5eb6b790aeb050831c6b4d
SHA512 3fb650c1687606ca50fd02c223fe004991b825cb30c3ca56a32b5c1830007bea37dd4d595cbd420b034edb734ed3263e3083d8cedf027124eaeccddb8c8519f8
SSDEEP 1536:ieRTDIo158UxyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:iUzKUxyfkMY+BES09JXAnyrZalI+YQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1424	msedge.exe
1424	msedge.exe
3232	msedge.exe
3232	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
1900	identity_helper.exe
1900	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 1208	3232	msedge.exe	84
PID 3232 wrote to memory of 1208	3232	msedge.exe	84
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 5056	3232	msedge.exe	85
PID 3232 wrote to memory of 1424	3232	msedge.exe	86
PID 3232 wrote to memory of 1424	3232	msedge.exe	86
PID 3232 wrote to memory of 4856	3232	msedge.exe	87
PID 3232 wrote to memory of 4856	3232	msedge.exe	87
PID 3232 wrote to memory of 4856	3232	msedge.exe	87
PID 3232 wrote to memory of 4856	3232	msedge.exe	87
PID 3232 wrote to memory of 4856	3232	msedge.exe	87
PID 3232 wrote to memory of 4856	3232	msedge.exe	87
PID 3232 wrote to memory of 4856	3232	msedge.exe	87
PID 3232 wrote to memory of 4856	3232	msedge.exe	87
PID 3232 wrote to memory of 4856	3232	msedge.exe	87
PID 3232 wrote to memory of 4856	3232	msedge.exe	87
PID 3232 wrote to memory of 4856	3232	msedge.exe	87
PID 3232 wrote to memory of 4856	3232	msedge.exe	87
PID 3232 wrote to memory of 4856	3232	msedge.exe	87
PID 3232 wrote to memory of 4856	3232	msedge.exe	87
PID 3232 wrote to memory of 4856	3232	msedge.exe	87
PID 3232 wrote to memory of 4856	3232	msedge.exe	87
PID 3232 wrote to memory of 4856	3232	msedge.exe	87
PID 3232 wrote to memory of 4856	3232	msedge.exe	87
PID 3232 wrote to memory of 4856	3232	msedge.exe	87
PID 3232 wrote to memory of 4856	3232	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0cf97ac881782d662f4f1e6f85c18af5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8299e46f8,0x7ff8299e4708,0x7ff8299e4718
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16649961403714303831,3574191013208341713,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,16649961403714303831,3574191013208341713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,16649961403714303831,3574191013208341713,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16649961403714303831,3574191013208341713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16649961403714303831,3574191013208341713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16649961403714303831,3574191013208341713,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16649961403714303831,3574191013208341713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16649961403714303831,3574191013208341713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16649961403714303831,3574191013208341713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16649961403714303831,3574191013208341713,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16649961403714303831,3574191013208341713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16649961403714303831,3574191013208341713,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:3708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562
MD5 dbac49e66219979194c79f1cf1cb3dd1
SHA1 4ef87804a04d51ae1fac358f92382548b27f62f2
SHA512 bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452
MD5 a9e55f5864d6e2afd2fd84e25a3bc228
SHA1 a5efcff9e3df6252c7fe8535d505235f82aab276
SHA512 12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7cb5a692487a6c4e15938bfe4c53ff76e6995b2845b959f615130a9a5b2a9e67
MD5 1210693484fddc72ca5b58acfbb79aca
SHA1 bf30a92204f2bb87d0f3917ad56bfcd3f6de069d
SHA512 6707e303be9ab03504f5a2e9a86bc085a62451168cc74b33b5bbe694f4b2340358b13a922f350db0dc9ec50615a4ba11e5494ce7476c184a3c444c8119a3ae3f
SSDEEP 96:nZ1kypN19tJaw/hXwpvWMoiVmdeHZquchUWQyV+VDCAiEwb:nZ1kaNBJauhXGWMXlchrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

d2c95ad4-fe6b-49d2-a212-fd4eafb3c059.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d2c95ad4-fe6b-49d2-a212-fd4eafb3c059.tmp
Size 5KB
SHA256 d71bf62b77621fc3aa9d9d160c0614634237307341a9d16216fa58beb457ff1e
MD5 cc12560f594f16a3f7c455e7dbf27d8d
SHA1 9e0251b1b7a933bb2d60c62014117b6c9308fb23
SHA512 a6e13acde87d4135f5f8a6306c858b5e4bce8a15905def2c13cb412c85940ab4d5d6db6ae6f2c6a395a451b67ca87ba53405b60f24e8a6c3c4d5a6876678ae37
SSDEEP 96:nZ1k7pN19tJaf/hXwpvWMoiVmdeHZquchUWQyV+VDCziEwb:nZ1klNBJaHhXGWMXlchro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8c54cf373f03f6d28d1ba7e1b4658d0d789eb414617523ce0da0186adde3eaf7
MD5 719f2b2ea11335c7a590d31d8359ffd8
SHA1 9d2e43c2a7c15b539af2411ee2355a8dc406dcac
SHA512 d00e7708ca0625e6abb9429a99dc0a46bbeba2b1703e4a14b0b5bcd668a874f5c710803011672572cdd2c236ba5cf45811082b03977e6f05e4271d4b5efcdc20
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup7Y/Me2RUrvNwqGSC+Oblfi:A9iIxuERzA83h09RZxY7qSQv8SC/XDaz
MD5 SHA1 SHA512 SSDEEP

Submit Download