0eaed43cbf743f50933568869fa8a18979003ae464585d37c2d01a0023f1494f

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8049645f47f83c1c6f5d6f4094151206_JaffaCakes118.html
Size 48KB
Sample240529-lld86aba47
SHA256 0eaed43cbf743f50933568869fa8a18979003ae464585d37c2d01a0023f1494f
MD5 8049645f47f83c1c6f5d6f4094151206
SHA1 b3aadc7ef210f37e90371ef2d247123d29c7de9c
SHA512 2e26247ed394a97372991d461de3590672a141d4a77b9a13498f9bad63c0cb0f1b9c01e1b62a79f21abdeb9b46c736a006ea2d5e4c3aaf9a974bdafea969d0d6
SSDEEP 384:TAuvwAuvwAuvVCRqz4bWB5Rj9fhiRwio9d8Vtlsu3mx/Ple:TAuvwAuvwAuvQFC5Rhhzj9dIzsuYe
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2248	msedge.exe
2248	msedge.exe
3396	msedge.exe
3396	msedge.exe
2824	identity_helper.exe
2824	identity_helper.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 2000	3396	msedge.exe	84
PID 3396 wrote to memory of 2000	3396	msedge.exe	84
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 1012	3396	msedge.exe	85
PID 3396 wrote to memory of 2248	3396	msedge.exe	86
PID 3396 wrote to memory of 2248	3396	msedge.exe	86
PID 3396 wrote to memory of 4100	3396	msedge.exe	87
PID 3396 wrote to memory of 4100	3396	msedge.exe	87
PID 3396 wrote to memory of 4100	3396	msedge.exe	87
PID 3396 wrote to memory of 4100	3396	msedge.exe	87
PID 3396 wrote to memory of 4100	3396	msedge.exe	87
PID 3396 wrote to memory of 4100	3396	msedge.exe	87
PID 3396 wrote to memory of 4100	3396	msedge.exe	87
PID 3396 wrote to memory of 4100	3396	msedge.exe	87
PID 3396 wrote to memory of 4100	3396	msedge.exe	87
PID 3396 wrote to memory of 4100	3396	msedge.exe	87
PID 3396 wrote to memory of 4100	3396	msedge.exe	87
PID 3396 wrote to memory of 4100	3396	msedge.exe	87
PID 3396 wrote to memory of 4100	3396	msedge.exe	87
PID 3396 wrote to memory of 4100	3396	msedge.exe	87
PID 3396 wrote to memory of 4100	3396	msedge.exe	87
PID 3396 wrote to memory of 4100	3396	msedge.exe	87
PID 3396 wrote to memory of 4100	3396	msedge.exe	87
PID 3396 wrote to memory of 4100	3396	msedge.exe	87
PID 3396 wrote to memory of 4100	3396	msedge.exe	87
PID 3396 wrote to memory of 4100	3396	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8049645f47f83c1c6f5d6f4094151206_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff935e46f8,0x7fff935e4708,0x7fff935e4718
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2296,5721212355664061977,768143298009076227,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2296,5721212355664061977,768143298009076227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2296,5721212355664061977,768143298009076227,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,5721212355664061977,768143298009076227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,5721212355664061977,768143298009076227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2296,5721212355664061977,768143298009076227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2296,5721212355664061977,768143298009076227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,5721212355664061977,768143298009076227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,5721212355664061977,768143298009076227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,5721212355664061977,768143298009076227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,5721212355664061977,768143298009076227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2296,5721212355664061977,768143298009076227,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4956 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 186B
SHA256 787a30749eba18ff2767a1c70f3769db2406ad85a7e55be56fcb54d8a2e0072b
MD5 0644ea0800b16bbc3eb3a6f28e69c016
SHA1 5d6d133999de7af72727b96b6e4a6d58c420f496
SHA512 722702a53cffc10e72525a6ed7f93b263ea92a5569b6ff8445d25aea2f0d09da975f74b223ceb64a24b91f751e92f67a66cd1a12c65ba2c35b6db1e920661621
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d86e02fcd294ce5e365939596c9d1f287f82869bb9274a7257f17d425f99bdf8
MD5 8aeaf76c9dfbf075f52babaf1fe3cd0c
SHA1 afd3fb5b05b57b3c893a6f1d0197b642e63059e2
SHA512 afdcb1775f8f460b8c65976e33ed0d1bb277d95a788ef167a4cc57ec4945126642d3caec33b13343f3dd67566ecb6a4c326463e0c0a50f19f098ba86c02f16de
SSDEEP 96:ndk5M1nlega9IQwpvWMoiVmdeHpCrBbNUWQyV+VD7ziEwb:ndk6LNaCQGWMXpGbNrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a805e30e53afb70e56726f9ce382b63f6cb8c6a8e1d9e8a053eea542880dd550
MD5 d8c4bfc4f48b6973d4796ea2116530d7
SHA1 1727a0326272f09fb0e53f9258dffc077e1f51b1
SHA512 7305999e96c8ee9f5ce89df9464eacabdc4268f844024ec5a7b52d733eb0f100951d3877dedc90093fd9e13f1f4e36a6601736e398afa8290804b322c18a7eec
SSDEEP 96:ndkEM1nlUga9IQwpvWMoiVmdec52pCrBbNUWQyV+VD7AiEwb:ndk9L3aCQGWMs52pGbNrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 efa7314f9048d0d8f0b0b69cf551931cab04cdf228a15470d02b6e7906d53b2b
MD5 a55f90ebc6990b133f854c6a8732c1d4
SHA1 a2721300e848c559dd33752d963c5f4ed6ac66af
SHA512 c08ea56b41ab7651de60b1d25b95ae146cbbf8088ce042b42e30998eb68c049f5b1d0f4b88724ecadd1078f360c09d3aafc2bfd34cff4d2b089867f47db5a3a3
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupykce2RUEjf7Zn3z2OMDCR8:A9iIxuERzA83h09RZxYykCZzZnaOMWR8
MD5 SHA1 SHA512 SSDEEP

Submit Download