fc01926e4617ce1a61e4f37b3947fb5e243214bc3793e1a8a917257afbcd5352

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
757611599866980ca74244b75623d1d7_JaffaCakes118.html
Size 30KB
Sample240526-pjdfmacf89
SHA256 fc01926e4617ce1a61e4f37b3947fb5e243214bc3793e1a8a917257afbcd5352
MD5 757611599866980ca74244b75623d1d7
SHA1 05e265ac962ccb6d5c238949b2406bf8740f8a95
SHA512 3c735dce4910f207a69691ba742d24e212339cac2c1a6f484562e6982d05676798273228a37f8f164ecc126efe41e292cd6d8a7d50a3b37b0c37562c15ef138b
SSDEEP 768:02k2qyq7+uh1ABtV4Rm/MHtMXWPZv2+C8TmpgQTl:02k2qyq7zzHtMXWPZv2+C8TmpgQTl
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2004	msedge.exe
2004	msedge.exe
5108	identity_helper.exe
5108	identity_helper.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 3548	2004	msedge.exe	83
PID 2004 wrote to memory of 3548	2004	msedge.exe	83
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 3956	2004	msedge.exe	84
PID 2004 wrote to memory of 2280	2004	msedge.exe	85
PID 2004 wrote to memory of 2280	2004	msedge.exe	85
PID 2004 wrote to memory of 2652	2004	msedge.exe	86
PID 2004 wrote to memory of 2652	2004	msedge.exe	86
PID 2004 wrote to memory of 2652	2004	msedge.exe	86
PID 2004 wrote to memory of 2652	2004	msedge.exe	86
PID 2004 wrote to memory of 2652	2004	msedge.exe	86
PID 2004 wrote to memory of 2652	2004	msedge.exe	86
PID 2004 wrote to memory of 2652	2004	msedge.exe	86
PID 2004 wrote to memory of 2652	2004	msedge.exe	86
PID 2004 wrote to memory of 2652	2004	msedge.exe	86
PID 2004 wrote to memory of 2652	2004	msedge.exe	86
PID 2004 wrote to memory of 2652	2004	msedge.exe	86
PID 2004 wrote to memory of 2652	2004	msedge.exe	86
PID 2004 wrote to memory of 2652	2004	msedge.exe	86
PID 2004 wrote to memory of 2652	2004	msedge.exe	86
PID 2004 wrote to memory of 2652	2004	msedge.exe	86
PID 2004 wrote to memory of 2652	2004	msedge.exe	86
PID 2004 wrote to memory of 2652	2004	msedge.exe	86
PID 2004 wrote to memory of 2652	2004	msedge.exe	86
PID 2004 wrote to memory of 2652	2004	msedge.exe	86
PID 2004 wrote to memory of 2652	2004	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\757611599866980ca74244b75623d1d7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe69fb46f8,0x7ffe69fb4708,0x7ffe69fb4718
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,4582274718993960069,16700044800115864087,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,4582274718993960069,16700044800115864087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,4582274718993960069,16700044800115864087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4582274718993960069,16700044800115864087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4582274718993960069,16700044800115864087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,4582274718993960069,16700044800115864087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,4582274718993960069,16700044800115864087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4582274718993960069,16700044800115864087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4582274718993960069,16700044800115864087,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4582274718993960069,16700044800115864087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4582274718993960069,16700044800115864087,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,4582274718993960069,16700044800115864087,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
MD5 87f7abeb82600e1e640b843ad50fe0a1
SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
MD5 SHA1 SHA512

Submit Download

93ea30a2-3c69-41b9-92d5-c6aff81ce422.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\93ea30a2-3c69-41b9-92d5-c6aff81ce422.tmp
Size 5KB
SHA256 5c7e28e0b9bd5d40a01a515b83123c104e7c821ee58091fdfbeeced5b87b2652
MD5 ae9b4b1117a554aeaa9e5f4971f1ab90
SHA1 5e7f0972c6bb08518e8076c743c95a81e22d582c
SHA512 505a231dd6166b467e613124eee1d5ed23504e562630eadcf19ed5694ba1fac2f4ae7edb71c141871746b433d85bfc17e8863462dfb491a5a354404e1300b2f1
SSDEEP 96:n7kiT16T0wpvWMoiVmdeH/zym1UWQyV+VDCziEwb:n7kYIgGWMXv1ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 187B
SHA256 3e6d4faec9e64cac42d817d0a25063227e058b81079ec5dad4232b63350aab90
MD5 6bc881fa8b603558de556c16afa4adc1
SHA1 55a36aeaec8b5ef89b5ad05b816928e21cf5523a
SHA512 5952514db8d59748f735d6467fda025d0a5ee065144486102eafb01d3f3024579810b9475307ae1396e49b381b8dc8dce6728ea833f1587987a5fc529220c093
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 50cace4e108e4a81f794bb28a28f3ae693f4eedf546ee3cca09d8dd0e4a9efe7
MD5 e9137bde5d46cc51706356e0f7481f95
SHA1 d7af10d00581ae9c341805c2cbf6136c34bfb7e1
SHA512 e3f1e99df554fbdde8cdad30b647585d8983a7aed98d494dcf37f7f763e0690fd25a961b52f9f0d4ab9294185ddfce5db605c2b5e422b9a21a40faaf4f35949c
SSDEEP 96:n7kZT16D0wpvWMoiVmdeH/zym1UWQyV+VD7AiEwb:n7kNIwGWMXv1rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6666a588373655fbb37bb659302588a1b41a978071bc55b625b45b5112541190
MD5 ec4bf8092da43c6de1e90edd004cf23d
SHA1 76bd531e9fde8055bf80beecd2b9d52a057acce8
SHA512 5e623a1a8e4ad8036836d4bbb8f47bc9dfb7784374bfa9e295494d5ca7f06d65efd2dff1190374a133e45af4260f13ebde1047e6345de889a6bb37080a8cb8cc
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup0vme2RUbmy+3z2OMDCRHqJ:A9iIxuERzA83h09RZxYKo4+aOMWRHqlz
MD5 SHA1 SHA512 SSDEEP

Submit Download