3ae934d3811eae2b114f2a097fbbf6cf647be99e793b66a7fc0756b453167b58

Analysis

max time kernel
145s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
743be36bb6b805f2b9784f7843bf142e_JaffaCakes118.html
Size 32KB
Sample240526-ea546sed87
SHA256 3ae934d3811eae2b114f2a097fbbf6cf647be99e793b66a7fc0756b453167b58
MD5 743be36bb6b805f2b9784f7843bf142e
SHA1 1ff5c6080cd288dc1176f39dafcb19f83d2954ac
SHA512 0d6db4637bb727dec5233bbb53c8506d482ae35725852bb5666a39ee45adfec8e9add9290fd5f234ddbc207af0fec57d67738a3b181059a5f7af624174e72922
SSDEEP 192:uW7Jb5nAn1nQjxn5Q/TnQieaNngnQOkEntxVnQTbnBnQAMC3AzYLWPY6NJoky9tq:oeQ/pxf6P9NQt3j2Oh6
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3576	msedge.exe
3576	msedge.exe
2408	identity_helper.exe
2408	identity_helper.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 5076	3576	msedge.exe	82
PID 3576 wrote to memory of 5076	3576	msedge.exe	82
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 4680	3576	msedge.exe	83
PID 3576 wrote to memory of 3440	3576	msedge.exe	84
PID 3576 wrote to memory of 3440	3576	msedge.exe	84
PID 3576 wrote to memory of 3792	3576	msedge.exe	85
PID 3576 wrote to memory of 3792	3576	msedge.exe	85
PID 3576 wrote to memory of 3792	3576	msedge.exe	85
PID 3576 wrote to memory of 3792	3576	msedge.exe	85
PID 3576 wrote to memory of 3792	3576	msedge.exe	85
PID 3576 wrote to memory of 3792	3576	msedge.exe	85
PID 3576 wrote to memory of 3792	3576	msedge.exe	85
PID 3576 wrote to memory of 3792	3576	msedge.exe	85
PID 3576 wrote to memory of 3792	3576	msedge.exe	85
PID 3576 wrote to memory of 3792	3576	msedge.exe	85
PID 3576 wrote to memory of 3792	3576	msedge.exe	85
PID 3576 wrote to memory of 3792	3576	msedge.exe	85
PID 3576 wrote to memory of 3792	3576	msedge.exe	85
PID 3576 wrote to memory of 3792	3576	msedge.exe	85
PID 3576 wrote to memory of 3792	3576	msedge.exe	85
PID 3576 wrote to memory of 3792	3576	msedge.exe	85
PID 3576 wrote to memory of 3792	3576	msedge.exe	85
PID 3576 wrote to memory of 3792	3576	msedge.exe	85
PID 3576 wrote to memory of 3792	3576	msedge.exe	85
PID 3576 wrote to memory of 3792	3576	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\743be36bb6b805f2b9784f7843bf142e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b3c846f8,0x7ff9b3c84708,0x7ff9b3c84718
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,17918558255854280434,34655866126767979,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,17918558255854280434,34655866126767979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,17918558255854280434,34655866126767979,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17918558255854280434,34655866126767979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17918558255854280434,34655866126767979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,17918558255854280434,34655866126767979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1456 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,17918558255854280434,34655866126767979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17918558255854280434,34655866126767979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17918558255854280434,34655866126767979,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17918558255854280434,34655866126767979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17918558255854280434,34655866126767979,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,17918558255854280434,34655866126767979,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 82b338eaa451307b5e1e8e4bfbc176297d3f1d1099cd6780f12f9b3706402d3c
MD5 72be54056cceedfccef9a0d9b0e852ce
SHA1 dacc9043f8010b07f90d06a9e6f20f3030676d20
SHA512 9943a9441df77dd7632011dd89d60b2082a302e5641a6d8ceae68f18e2405c3b2017dce8cd7ca855f3d091bb3e0cc4f241b0c077be3ceca229445e357b1daf5c
SSDEEP 96:nVkC41IH2wpvWMoiVmdeHk4iu/UWQyV+VDCziEwb:nVkbOH2GWMXEaro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 549511d58e5386bc490f20063412e536364c9e68f8d35758c0ca61bec42a404f
MD5 88865f9244cc6e16aaf500617e641f2d
SHA1 0758d18d0546e55ccfd014860ef666a4642df34a
SHA512 d7319557f564df8cc730369df3155f02d0af6c4e1a87b95ad1590977290707c7fdd96859015fc19e54ce8ad2b45a7c6d5062bbac01536ed7c23ef4f844792a18
SSDEEP 96:nVk541IC2wpvWMoiVmdeHk4iu/UWQyV+VDCAiEwb:nVkeOC2GWMXEarV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 aff9cead4cac16f776d55413c81388c0bc754f1b8ce01b2e0a3020233398b496
MD5 466c0e4b2bd67528cf3fea87527fed52
SHA1 dcdfaf69b7016462453aad73e40841e493267c47
SHA512 cf4e3f3180659a3780dabebc6f68c6d8aa0abc6ad5fce0d9c7547a716add943e70fb5b536e1e442e6270f6a2e7230abeb1f541ac6295c6fa12ab346a8df9ee2c
SSDEEP 96:nVk541IH2wpvWMoiVmdeHk4iu/UWQyV+VDCAiEwb:nVkeOH2GWMXEarV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6f596731041e3c422510683978603258dcb00d7105af15c9acd73495dc46d659
MD5 556026da1d407afb8c0a6956267abc1b
SHA1 7a64068e2c36b2d848fff7465e7fd06e7701490e
SHA512 861298fedb470c322d2526c285e703fa9ae1fa2b8d960c1a94c8ed56b44e94a036d9c0b202b8e8644a933e1d96bf3191eba56c0a30cffc51034f35b8ae9a1301
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupn6e2RU6/y4Vp3z2OMDCRHv:A9iIxuERzA83h09RZxYU75paOMWRHql2
MD5 SHA1 SHA512 SSDEEP

Submit Download