d033040e7525770a19888f1dbb51226463ec312677ce8965296ff87935539cc2

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 09:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8048594a0fd1332e092d459c11437a17_JaffaCakes118.html
Size 40KB
Sample240529-lkf2csba26
SHA256 d033040e7525770a19888f1dbb51226463ec312677ce8965296ff87935539cc2
MD5 8048594a0fd1332e092d459c11437a17
SHA1 e3d7f2568894c8a9836207a3c3352cfc2d60f108
SHA512 903df80ec1f12156dc4a9d4f440e429024d44c97bcf6e9ca54e00d559bfef187c735a26d5e67373017848d996b485766285f1f20216ed356e945faabff758646
SSDEEP 384:onfDPOCqRQ5Im2V9cqVB4vysGUQvODw3brnxLHnd1IwntO/Na6s0pPylPe18d7ba:onfD2CYQOzVeqNsGdfxLxpcWrQBAy
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4368	msedge.exe
4368	msedge.exe
2860	identity_helper.exe
2860	identity_helper.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 3828	4368	msedge.exe	82
PID 4368 wrote to memory of 3828	4368	msedge.exe	82
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 1584	4368	msedge.exe	83
PID 4368 wrote to memory of 4456	4368	msedge.exe	84
PID 4368 wrote to memory of 4456	4368	msedge.exe	84
PID 4368 wrote to memory of 3772	4368	msedge.exe	85
PID 4368 wrote to memory of 3772	4368	msedge.exe	85
PID 4368 wrote to memory of 3772	4368	msedge.exe	85
PID 4368 wrote to memory of 3772	4368	msedge.exe	85
PID 4368 wrote to memory of 3772	4368	msedge.exe	85
PID 4368 wrote to memory of 3772	4368	msedge.exe	85
PID 4368 wrote to memory of 3772	4368	msedge.exe	85
PID 4368 wrote to memory of 3772	4368	msedge.exe	85
PID 4368 wrote to memory of 3772	4368	msedge.exe	85
PID 4368 wrote to memory of 3772	4368	msedge.exe	85
PID 4368 wrote to memory of 3772	4368	msedge.exe	85
PID 4368 wrote to memory of 3772	4368	msedge.exe	85
PID 4368 wrote to memory of 3772	4368	msedge.exe	85
PID 4368 wrote to memory of 3772	4368	msedge.exe	85
PID 4368 wrote to memory of 3772	4368	msedge.exe	85
PID 4368 wrote to memory of 3772	4368	msedge.exe	85
PID 4368 wrote to memory of 3772	4368	msedge.exe	85
PID 4368 wrote to memory of 3772	4368	msedge.exe	85
PID 4368 wrote to memory of 3772	4368	msedge.exe	85
PID 4368 wrote to memory of 3772	4368	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8048594a0fd1332e092d459c11437a17_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0a6a46f8,0x7fff0a6a4708,0x7fff0a6a4718
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,11291345122569512519,4253513722922312073,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,11291345122569512519,4253513722922312073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,11291345122569512519,4253513722922312073,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11291345122569512519,4253513722922312073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11291345122569512519,4253513722922312073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,11291345122569512519,4253513722922312073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,11291345122569512519,4253513722922312073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11291345122569512519,4253513722922312073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11291345122569512519,4253513722922312073,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11291345122569512519,4253513722922312073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11291345122569512519,4253513722922312073,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,11291345122569512519,4253513722922312073,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 390B
SHA256 9e1a80e15bb26c3a1526ed3ce422feeb899e2b69d6bd19b7b7a94d1ec8dbc57b
MD5 a9d5d2cba8864e9335d7cfcf7c1e64ed
SHA1 20847a796eaa1dd5f38123f2cce5c0e9f620a750
SHA512 ddbc3ff790f8b1d725cb7c49e1033c5cdc907f42c42b1d7f0ccb6c47eadea052bfaedbd795c8b5905603ee81c20e53b9e3ea6e6b49c7b8efd815d69732b3386c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5e1703e747a13a6a81d6c5b8cb498f54e029f38ffc7b03619f40c450e3f2dd0f
MD5 7613a8fe66db476d23770e354006c9ee
SHA1 a6fbb6fc4ddc0c52065dc4b29404bbdfc1b3b2fc
SHA512 b758ebcce49173d315348c626f09e134d7d5060273d044a4a561d97626245c14146a9837c6ccdfae619a457260269159e5b5065c03473f9ffc46b58aa124e5ee
SSDEEP 96:nxkib1h1wpvWMoiVmdeHBrzmUWQyV+VDCziEwb:nxko31GWMXEro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4ec6e15e348fa7670a4dadf268b8c26d274d52f56f6a8c0b52146287c26fa343
MD5 2aaf06de6f29a13069312c58fdcf5ab3
SHA1 2e944159cd075bd2fe32bd9c97440df9a4307866
SHA512 a83612ea21ad63bb13f1c178722aa24d9164d0dd88e174e171b88d56adadb0f3f0eaa8ed3425bc4b2d51fa32ae3336f399be0f5eedfbd233bbdc36b48e5c2a39
SSDEEP 96:nxkZb1howpvWMoiVmdeHBrzmUWQyV+VD7AiEwb:nxkt3oGWMXErg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2ea37cead8cf1c6c771554b4a4999939ff65698d97296c983a31328f3d344869
MD5 6422869083f54f11f6df4d9ebdcbc352
SHA1 f436eccc17b234377515005f953c2a1ddf343bdc
SHA512 b6da83a9222883b541299aaca2eec6de082317c1a12651605f42ce20450956d4776eef70c9bfa1b8f4ed797c136257531e0fc9c7e7a48b4f38b920ac56e12720
SSDEEP 96:nxkZb1h1wpvWMoiVmdeHBrzmUWQyV+VDCAiEwb:nxkt31GWMXErV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f3f58f30102658bb3e0dc641f9b9f1a762cd8d6b7d4b79ac403ce8b3cffa3c9f
MD5 e9348fe2af0f40160e571c5693bd3075
SHA1 5c43ee0186d745195a1c23ed7131f2f5e8410c25
SHA512 7d0405e8c234c48f0aad7e158cfb50ce154a5c4996085f819f05cf33e36b9847923f8016034c10d13cb13ec4b65fa3bc9cf155feb521fd514cc686f6e179cfa2
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupp4Hae2RUdMj2n3z2OMDCRB:A9iIxuERzA83h09RZxYp4H0TynaOMWRB
MD5 SHA1 SHA512 SSDEEP

Submit Download