78ee615b3a261b30c4eb238660f8cc10aa6549f358945bcd7960c68242114b2f

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7d4d97a25e80c08974a944c0bb597d33_JaffaCakes118.html
Size 36KB
Sample240528-rwaxdaab97
SHA256 78ee615b3a261b30c4eb238660f8cc10aa6549f358945bcd7960c68242114b2f
MD5 7d4d97a25e80c08974a944c0bb597d33
SHA1 388388f216fd177d7dca4eaa2ba42661cfb454b0
SHA512 8d925654119ce7c26d677842b6c959fecd97f7e9aa737ad255df55623eda7a432cf76e69c6dc605cd55ef31f372d1ed7f0ce346ad11290fec5cb37aead1c43a9
SSDEEP 768:zwx/MDTHvX88hARuZPXBE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TbiD6eGx6OxJy6/:Q/zbJxNVdu6SQ/C8ZK
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
8	msedge.exe
8	msedge.exe
2240	identity_helper.exe
2240	identity_helper.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 4592	8	msedge.exe	84
PID 8 wrote to memory of 4592	8	msedge.exe	84
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4572	8	msedge.exe	85
PID 8 wrote to memory of 4656	8	msedge.exe	86
PID 8 wrote to memory of 4656	8	msedge.exe	86
PID 8 wrote to memory of 3088	8	msedge.exe	87
PID 8 wrote to memory of 3088	8	msedge.exe	87
PID 8 wrote to memory of 3088	8	msedge.exe	87
PID 8 wrote to memory of 3088	8	msedge.exe	87
PID 8 wrote to memory of 3088	8	msedge.exe	87
PID 8 wrote to memory of 3088	8	msedge.exe	87
PID 8 wrote to memory of 3088	8	msedge.exe	87
PID 8 wrote to memory of 3088	8	msedge.exe	87
PID 8 wrote to memory of 3088	8	msedge.exe	87
PID 8 wrote to memory of 3088	8	msedge.exe	87
PID 8 wrote to memory of 3088	8	msedge.exe	87
PID 8 wrote to memory of 3088	8	msedge.exe	87
PID 8 wrote to memory of 3088	8	msedge.exe	87
PID 8 wrote to memory of 3088	8	msedge.exe	87
PID 8 wrote to memory of 3088	8	msedge.exe	87
PID 8 wrote to memory of 3088	8	msedge.exe	87
PID 8 wrote to memory of 3088	8	msedge.exe	87
PID 8 wrote to memory of 3088	8	msedge.exe	87
PID 8 wrote to memory of 3088	8	msedge.exe	87
PID 8 wrote to memory of 3088	8	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7d4d97a25e80c08974a944c0bb597d33_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd711f46f8,0x7ffd711f4708,0x7ffd711f4718
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,10039953681468245584,8753722462700646581,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,10039953681468245584,8753722462700646581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,10039953681468245584,8753722462700646581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10039953681468245584,8753722462700646581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10039953681468245584,8753722462700646581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,10039953681468245584,8753722462700646581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,10039953681468245584,8753722462700646581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10039953681468245584,8753722462700646581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10039953681468245584,8753722462700646581,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10039953681468245584,8753722462700646581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10039953681468245584,8753722462700646581,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,10039953681468245584,8753722462700646581,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6bb417c9-db6f-43ae-8b4a-262e0a596e0f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6bb417c9-db6f-43ae-8b4a-262e0a596e0f.tmp
Size 11KB
SHA256 0f840a1be0857bd7c4afcc20f75e093e328e812ac60a9e5dace4e4482c06200d
MD5 595a1d1c8230ede5b7009cbbba83d156
SHA1 a6b15208d937fb73deaf57d106fac8ebd1f307dd
SHA512 d1ef65d604d7c5d58b321349a813847afcbe4c40b618b7a6da7e14fb88605f5b9c8a701d17282b51431bbbd5f8fd130415a10022fc5f8c9222180fa26511fbda
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRJe2RUxhy4Vd3z2OMDCRHB:A9iIxuERzA83h09RZxYP2PdaOMWRHqls
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 613B
SHA256 98200b8435f5d99be6b2cf79e16aa311aebd28cef5ebdefe406be3a9303a7c3e
MD5 2ebd0b9322d782a3b4ea4c1c2b0fc757
SHA1 104f5b0a539d6b6631dc9ae69fbb1a236d613752
SHA512 0ef7c23738954ae577973020b2aa2da88bc9acc4c8182247f824715730dc01cadb15c1410aa354d79ebfb5ed9256a516c1f8b1f658ad8205083d5068d49db34a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 9b295dbba00144ad1eed87219fed45c4fa3bb9b0abe52b845c82c30a1dd30142
MD5 bb0cbee0cd72fd8ea436d15bb0bf26ef
SHA1 90f87ed3f0836ca6e371d65349f1ec14aca7df86
SHA512 cdf048fc7b5a2630e6b5fdb990667884213faaa4fd62fc76b90804b08fc543d4626cb79efaddbcf500e8b6774d737057625b97864156c68dcf942a03dd83b09b
SSDEEP 96:nmku81Q0T2wpvWMoiVmdeHk4W5UWQyV+VDCziEwb:nmkvq0T2GWMXA5ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7d7b91683740a74985caa02527103ab04e9b7fc468cc17bf00533d070349ac87
MD5 5f053785f29d66fcb4fa9add76ca6709
SHA1 aabb981bc4ec5561fb66789e5b0d66d2aa6b19d0
SHA512 aab69459304e699d805a01dcc99b948038e299320ba120b2e287e0e25277e9fdc90333acd607c16268591284c239531eeed664768f9ed0df5fdc6961fb6ea34b
SSDEEP 96:nmkl81Q072wpvWMoiVmdeEMd52k4W5UWQyV+VD7AiEwb:nmkaq072GWMvd52A5rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download