e24436cf2917371167e2d080449191e0bb4f8073bf1d7ebebebb6b9341b2331a

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
709c9bd149c2b4627532204497ab307b_JaffaCakes118.html
Size 18KB
Sample240525-c7c4jsca45
SHA256 e24436cf2917371167e2d080449191e0bb4f8073bf1d7ebebebb6b9341b2331a
MD5 709c9bd149c2b4627532204497ab307b
SHA1 cfa5a921bbddd88008bc2655add3f549eae79616
SHA512 27897e1ffb698919da30e3dd60aabe72066d9dc2ecb458f08708142e00b47522ae7986b47a86e0a387b42851fefe3a22659795fc1d7a5b487316dd8cfe6a6774
SSDEEP 384:AT6XBUzBMFJKTTwcORbySBy6Mr3cznrIx1:aMBUzCoWVzrIx1
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
2860	msedge.exe
2860	msedge.exe
4504	identity_helper.exe
4504	identity_helper.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 5040	2860	msedge.exe	85
PID 2860 wrote to memory of 5040	2860	msedge.exe	85
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 2220	2860	msedge.exe	86
PID 2860 wrote to memory of 3628	2860	msedge.exe	87
PID 2860 wrote to memory of 3628	2860	msedge.exe	87
PID 2860 wrote to memory of 4940	2860	msedge.exe	88
PID 2860 wrote to memory of 4940	2860	msedge.exe	88
PID 2860 wrote to memory of 4940	2860	msedge.exe	88
PID 2860 wrote to memory of 4940	2860	msedge.exe	88
PID 2860 wrote to memory of 4940	2860	msedge.exe	88
PID 2860 wrote to memory of 4940	2860	msedge.exe	88
PID 2860 wrote to memory of 4940	2860	msedge.exe	88
PID 2860 wrote to memory of 4940	2860	msedge.exe	88
PID 2860 wrote to memory of 4940	2860	msedge.exe	88
PID 2860 wrote to memory of 4940	2860	msedge.exe	88
PID 2860 wrote to memory of 4940	2860	msedge.exe	88
PID 2860 wrote to memory of 4940	2860	msedge.exe	88
PID 2860 wrote to memory of 4940	2860	msedge.exe	88
PID 2860 wrote to memory of 4940	2860	msedge.exe	88
PID 2860 wrote to memory of 4940	2860	msedge.exe	88
PID 2860 wrote to memory of 4940	2860	msedge.exe	88
PID 2860 wrote to memory of 4940	2860	msedge.exe	88
PID 2860 wrote to memory of 4940	2860	msedge.exe	88
PID 2860 wrote to memory of 4940	2860	msedge.exe	88
PID 2860 wrote to memory of 4940	2860	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\709c9bd149c2b4627532204497ab307b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf44a46f8,0x7ffaf44a4708,0x7ffaf44a4718
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,13176522513561307136,15335852499218936452,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,13176522513561307136,15335852499218936452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,13176522513561307136,15335852499218936452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13176522513561307136,15335852499218936452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13176522513561307136,15335852499218936452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,13176522513561307136,15335852499218936452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,13176522513561307136,15335852499218936452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13176522513561307136,15335852499218936452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13176522513561307136,15335852499218936452,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13176522513561307136,15335852499218936452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13176522513561307136,15335852499218936452,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,13176522513561307136,15335852499218936452,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 251B
SHA256 a97c081d1c6e7ec47fd3cd722a167d3948392ea58b92d1d8e835600fc2f45b3c
MD5 7d415a191ec19465cd93270bb27c0b16
SHA1 6fdde2fdc0ce940cdc9a557c095dc4c1a8fa939a
SHA512 dabd91dab9a1cb021e54fba542d1de97cf398fea924131efc95729405b046d10fdd0b010163193903240090a2b9adf643edec772d9082b4391afb2eac52c1f27
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f72b778b54423e85790709a13d3fd7c1c1a4d833f41c32612cdd9ecaa8405aca
MD5 af280c0ed22a44d17db406b080b4e0c7
SHA1 7e0dd1eec928d9d0b558a4e1d9e0856da227ac07
SHA512 8c283c2c40625b92b007ad2dd7e1801b29ce7f06a33267af72c606bfbff7d43c6e526e44a859278857603f06a2b57a7a013583f36e4e652a2a50873a529a3ed3
SSDEEP 96:nqk5fn1uega9IQwpvWMoiVmdeHpCrnb2O+UWQyV+VD7ziEwb:nqkNnsNaCQGWMXpYbV+rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9b760a6924505a898c716d971f020861444fddf28049b723589b410b814ed808
MD5 1b19deabc2b56d60f5dfcbea514f1980
SHA1 bd40679fa4695f2cbcc4d57b616ebd4f3972dd14
SHA512 59dc0eaa727711855364306e1700d938027b32830039677c55e9ed771faccc741a35e548b18d752dafff8761d98fb695a2e788b45ba6e422b49eabe540a2c56b
SSDEEP 96:nqkEfn1uZga9IQwpvWMoiVmder2pCrnb2O+UWQyV+VD7AiEwb:nqk2nsuaCQGWM72pYbV+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d6ec148c90dd8eac25f0d504f63b13d9366eecac9c2b6eb489cee7930dde21b6
MD5 5ec2cbc85321e7a6489ef21a75332472
SHA1 cbab7a0a047de7c90f56c4072d066138467edd20
SHA512 a30386916efbc8a406fff0a8ff610bbc698e6b7d9e90db51ee41ea86e7671ab262e446a178d0b34518f76d998239b4d5deba5d451389c9fdd5f11a2fc99b751a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupBkfe2RUM2Hjf7ZT3z2OMDc:A9iIxuERzA83h09RZxYBknOzZTaOMWR7
MD5 SHA1 SHA512 SSDEEP

Submit Download