af559c9ef1c5c78e74d29b36a86f4aca4e11566258a6da4cc3e1996e6c40d0a0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1ef6c250f880c969f870d00de02d7f75_JaffaCakes118.html
Size 124KB
Sample240507-brdjpsca6z
SHA256 af559c9ef1c5c78e74d29b36a86f4aca4e11566258a6da4cc3e1996e6c40d0a0
MD5 1ef6c250f880c969f870d00de02d7f75
SHA1 8ecff25f3a48f3c066f9458e1624edead944fd62
SHA512 b021cb443cd2c2e6d25a177a2aac1ddcfee15c4735334c9ad69de1d064f8c6c18c6c388895d29494b68575ce8a410ea403a95b43eba5916857ccb927013c6b38
SSDEEP 1536:puryLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsn:puryfkMY+BES09JXAnyrZalI+YQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
1772	msedge.exe
1772	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 828	1772	msedge.exe	84
PID 1772 wrote to memory of 828	1772	msedge.exe	84
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 2064	1772	msedge.exe	85
PID 1772 wrote to memory of 1972	1772	msedge.exe	86
PID 1772 wrote to memory of 1972	1772	msedge.exe	86
PID 1772 wrote to memory of 4860	1772	msedge.exe	87
PID 1772 wrote to memory of 4860	1772	msedge.exe	87
PID 1772 wrote to memory of 4860	1772	msedge.exe	87
PID 1772 wrote to memory of 4860	1772	msedge.exe	87
PID 1772 wrote to memory of 4860	1772	msedge.exe	87
PID 1772 wrote to memory of 4860	1772	msedge.exe	87
PID 1772 wrote to memory of 4860	1772	msedge.exe	87
PID 1772 wrote to memory of 4860	1772	msedge.exe	87
PID 1772 wrote to memory of 4860	1772	msedge.exe	87
PID 1772 wrote to memory of 4860	1772	msedge.exe	87
PID 1772 wrote to memory of 4860	1772	msedge.exe	87
PID 1772 wrote to memory of 4860	1772	msedge.exe	87
PID 1772 wrote to memory of 4860	1772	msedge.exe	87
PID 1772 wrote to memory of 4860	1772	msedge.exe	87
PID 1772 wrote to memory of 4860	1772	msedge.exe	87
PID 1772 wrote to memory of 4860	1772	msedge.exe	87
PID 1772 wrote to memory of 4860	1772	msedge.exe	87
PID 1772 wrote to memory of 4860	1772	msedge.exe	87
PID 1772 wrote to memory of 4860	1772	msedge.exe	87
PID 1772 wrote to memory of 4860	1772	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1ef6c250f880c969f870d00de02d7f75_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe4d6046f8,0x7ffe4d604708,0x7ffe4d604718
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,13778499937033133389,14240219024549282272,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,13778499937033133389,14240219024549282272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,13778499937033133389,14240219024549282272,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13778499937033133389,14240219024549282272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13778499937033133389,14240219024549282272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13778499937033133389,14240219024549282272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,13778499937033133389,14240219024549282272,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a52697e2fc77fe5a5c428946ed9602fc4e6f122bc48279060c35ab8abe0c184a
MD5 65ff0b2a1af0f7b97d220413186a0e0c
SHA1 2bfafa54a04d9000d508f9276a951f6cb918f7ff
SHA512 a0841b4984fe8fe11cfbf2b76a3c9c647fe0edec76a53dcd48ff5adf842db12cd5fc46311bbdd846e08d72e5c40e1f9cac70af4375e5b5726197ff388b94ca9b
SSDEEP 96:n1k+xm/eQYmqx1bv3wpvWMoiVmdeHplwt9acMTUWQyV+VDCziEwb:n1kTHGRvGWMXpoXMTro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 19fadefacddeb5a86cdd5417e21b3a2f4e11d1d56633cfebdc2d7366ca3c195f
MD5 5ccf7dc84d2a613c847169d8cf688b47
SHA1 3742774e7c98b2fcc25747d3dcc830deb6adeffe
SHA512 3169a46b38262a7b12ee88436971d974abd4ff564608dbd733e9bf16b4490be20417b7c4527f68ba11de34f1fd7a7b7f2eb7b90b0c10462b359efbf379e9c8de
SSDEEP 96:n1k+xm/enmqx1bv3wpvWMoiVmdeHplwt9acMTUWQyV+VDCAiEwb:n1kTZGRvGWMXpoXMTrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2e7477a89697f52f712c36277084a99a46cf0bdcfdb40ca8eadc9e9cbce5af93
MD5 4a653e3d87b079ba0e33fa004fd79e81
SHA1 4a28d359a7a03512f462bc78521fdaf3460d2a41
SHA512 3bb0d3ffbf86b0556719d4b7ee24666aa66ab9c1584a89a6b9659494062a5d388fdd59df6dcde5fa1bd53dfd395abeb9b80bea35bbfc636fbaa48cf9d91920e5
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupgse2RUTrfZi+OblfBhDaaY:A9iIxuERzA83h09RZxYzEi/XDafEBvg
MD5 SHA1 SHA512 SSDEEP

Submit Download