256b6467868eec2f8f2eff55ee3a5df92150aab0de6d39c6b1317fd6ac717452

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 08:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20019ae441112eb53cd2b1525870b436_JaffaCakes118.html
Size 146KB
Sample240507-j6ghxaba83
SHA256 256b6467868eec2f8f2eff55ee3a5df92150aab0de6d39c6b1317fd6ac717452
MD5 20019ae441112eb53cd2b1525870b436
SHA1 0232e847fd29114de9dd39324d67d398024ee7e0
SHA512 dab381c1ca9eb6e722b0472f02f9101d12aab9a3439dde9718943582ba3b05ddb63c6b2798850255c5b1aa7cc1584141250c8100bb47471adc0dbcadaf58b2fd
SSDEEP 3072:S/p9jP/bBSwnir0ep2jVQzuERY78LKaDdobjIv9uMxE/nTFm:S/NSwnir0ep2jVQzuERY78LKaDdobjIP
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
692	msedge.exe
692	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 1912	692	msedge.exe	83
PID 692 wrote to memory of 1912	692	msedge.exe	83
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 1452	692	msedge.exe	84
PID 692 wrote to memory of 4600	692	msedge.exe	85
PID 692 wrote to memory of 4600	692	msedge.exe	85
PID 692 wrote to memory of 1932	692	msedge.exe	86
PID 692 wrote to memory of 1932	692	msedge.exe	86
PID 692 wrote to memory of 1932	692	msedge.exe	86
PID 692 wrote to memory of 1932	692	msedge.exe	86
PID 692 wrote to memory of 1932	692	msedge.exe	86
PID 692 wrote to memory of 1932	692	msedge.exe	86
PID 692 wrote to memory of 1932	692	msedge.exe	86
PID 692 wrote to memory of 1932	692	msedge.exe	86
PID 692 wrote to memory of 1932	692	msedge.exe	86
PID 692 wrote to memory of 1932	692	msedge.exe	86
PID 692 wrote to memory of 1932	692	msedge.exe	86
PID 692 wrote to memory of 1932	692	msedge.exe	86
PID 692 wrote to memory of 1932	692	msedge.exe	86
PID 692 wrote to memory of 1932	692	msedge.exe	86
PID 692 wrote to memory of 1932	692	msedge.exe	86
PID 692 wrote to memory of 1932	692	msedge.exe	86
PID 692 wrote to memory of 1932	692	msedge.exe	86
PID 692 wrote to memory of 1932	692	msedge.exe	86
PID 692 wrote to memory of 1932	692	msedge.exe	86
PID 692 wrote to memory of 1932	692	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\20019ae441112eb53cd2b1525870b436_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9178446f8,0x7ff917844708,0x7ff917844718
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,12965800530046364479,6973248107432505115,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,12965800530046364479,6973248107432505115,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,12965800530046364479,6973248107432505115,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12965800530046364479,6973248107432505115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12965800530046364479,6973248107432505115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12965800530046364479,6973248107432505115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12965800530046364479,6973248107432505115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,12965800530046364479,6973248107432505115,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b
MD5 62c02dda2bf22d702a9b3a1c547c5f6a
SHA1 8f42966df96bd2e8c1f6b31b37c9a19beb6394d6
SHA512 a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a
MD5 850f27f857369bf7fe83c613d2ec35cb
SHA1 7677a061c6fd2a030b44841bfb32da0abc1dbefb
SHA512 7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 57ac2df4bdee8fa51fcbe4badb3b4c3067c20d7274b8eea0c8a57262b117f7fe
MD5 3873d23e472214c957b2d5c2277353d3
SHA1 fe9cff8b06427f9934770651578c0f5f924f1e6e
SHA512 e2c4852cc2a1c5689e325adb826c2e2bcd895381206b66829569985000ce1e223a4608e07697e550a425e4afb86a4efe37bfc9ff05607d5473d40eee90466d62
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 8ef9998fe8049243ad45ace1f10ac8032608fdb0371928265a61c3ae578367dd
MD5 48ea95d0523e160c8051b1a550d1f49a
SHA1 d7a88179491046dd917aeaeda304761d02b99184
SHA512 7ee8362ae145b6f010bdd955a64199b548234b0c059698de1d2797c316c4ac57f7074352ac8320c21a94d5801268c4b69434d28b883363b3871b4d80e02055f5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 cb3796f25d25b3215d31c8893f8eabfa10f0e321e0ad1473a89e7ea673a32ec7
MD5 c480830ea8702935184e805c5891c227
SHA1 9fd456731773c8f5daadee24c5abb78159a3e5ce
SHA512 4c14f8a676d6615dbf80f33c903a50a84872a68a839f54c3d6877d73ef707179e6161a49cb51ecb0464b87ff7ae25bfc249acfdb71930b60884f6776a8c8c20d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c55aa1ff22ec3edfb340828ed038ac28208c1aa06372195fd945fa930653810a
MD5 24048ca47f2b84c8b71929ee48c5c9a4
SHA1 800a05e535ed76de544bcd3b784920b42bde1175
SHA512 92e1d886bf6d8196598253fad1b5a8daa94929c2d897c35900b01776a9914c45ef601b87f7d73fffc97e392c1aaf5ed71f063a4d39e9e4d3442ef864c12acccf
SSDEEP 96:nXksy11SfTwpvWMoiVmdeQ1SzEGEry7OT2qVVUWQyV+VDCAiEwb:nXkbbSfTGWMggYGEry7OT2mrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 7a60945ef9b966e3ef866faee9e41ecc8faf6a968356fcbc853069ae41c77180
MD5 e2999af1ceeb06ca7fb4d1172cbb1cee
SHA1 06ff6d1a8feab1381650e58ca14b297feafb0b44
SHA512 51e72649f8b44c30a3fb1df39bd6f131c4d01af45db12d8f41d78c725e4fc2a93d788aa5901a20dbcb3f4452fbdc80c31f904b07895320e2f87134275f00d42b
SSDEEP 96:nXkhy11SfTwpvWMoiVmdeHqVVUWQyV+VDCziEwb:nXkUbSfTGWMXmro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c022d228a37422810c4eca2b4ed3f007e1cd3cfbc51fe0b6e4a8742fd430ec1e
MD5 04c7243bd70f8cb7d63b18c828348c8f
SHA1 e6ec97711ce1ae7559cb9515465e5a3e0c89c109
SHA512 6d609dafc34b61db882d82d57e8defbc7efba5a0431e1cb02afe92eda0650ecbeb0c3a7ece062acf63e38775cc7b83b8ac7ef8bbb8b6f27e415e1f271816ce72
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup889e2RU/OEVCUW+OblfBhd:A9iIxuERzA83h09RZxYFNUW/XDafEB++
MD5 SHA1 SHA512 SSDEEP

Submit Download