1af00eb2db02656b5e83e7c1be2ac1faa6f53c78c70163f1250ef89098131f7a

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8084afaed614b29f10fa5d0f71d15270_JaffaCakes118.html
Size 207KB
Sample240529-m46a2ada85
SHA256 1af00eb2db02656b5e83e7c1be2ac1faa6f53c78c70163f1250ef89098131f7a
MD5 8084afaed614b29f10fa5d0f71d15270
SHA1 c21288df1bd99ca2c7b8ca1bb374b1d7220f4a09
SHA512 41d79af773c719f36e7ff3b6d46b63295173ab562edc1f3c91e274e27d71dee5278c0107cbd91b0bd96d6e1e53c930ab416105bfcbf4a9e3bf6e0e9225788962
SSDEEP 6144:o530DH6NEQwjcHXxQRVufJc/09Z1kEQ5H:ouDHQmjcxQRVufJc/jH
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
1320	msedge.exe
1320	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1868	1320	msedge.exe	83
PID 1320 wrote to memory of 1868	1320	msedge.exe	83
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1960	1320	msedge.exe	84
PID 1320 wrote to memory of 1604	1320	msedge.exe	85
PID 1320 wrote to memory of 1604	1320	msedge.exe	85
PID 1320 wrote to memory of 2180	1320	msedge.exe	86
PID 1320 wrote to memory of 2180	1320	msedge.exe	86
PID 1320 wrote to memory of 2180	1320	msedge.exe	86
PID 1320 wrote to memory of 2180	1320	msedge.exe	86
PID 1320 wrote to memory of 2180	1320	msedge.exe	86
PID 1320 wrote to memory of 2180	1320	msedge.exe	86
PID 1320 wrote to memory of 2180	1320	msedge.exe	86
PID 1320 wrote to memory of 2180	1320	msedge.exe	86
PID 1320 wrote to memory of 2180	1320	msedge.exe	86
PID 1320 wrote to memory of 2180	1320	msedge.exe	86
PID 1320 wrote to memory of 2180	1320	msedge.exe	86
PID 1320 wrote to memory of 2180	1320	msedge.exe	86
PID 1320 wrote to memory of 2180	1320	msedge.exe	86
PID 1320 wrote to memory of 2180	1320	msedge.exe	86
PID 1320 wrote to memory of 2180	1320	msedge.exe	86
PID 1320 wrote to memory of 2180	1320	msedge.exe	86
PID 1320 wrote to memory of 2180	1320	msedge.exe	86
PID 1320 wrote to memory of 2180	1320	msedge.exe	86
PID 1320 wrote to memory of 2180	1320	msedge.exe	86
PID 1320 wrote to memory of 2180	1320	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8084afaed614b29f10fa5d0f71d15270_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdb8546f8,0x7ffcdb854708,0x7ffcdb854718
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,901500128563930039,6853522978571805413,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,901500128563930039,6853522978571805413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,901500128563930039,6853522978571805413,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,901500128563930039,6853522978571805413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,901500128563930039,6853522978571805413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,901500128563930039,6853522978571805413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,901500128563930039,6853522978571805413,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 869dd4f19cc49708f84508dfdf35cc4cc4720f75029b02e139dc11a419c6037e
MD5 635818988298b766ad789283efffe85a
SHA1 376523d702034379e530585062aa675688866f6c
SHA512 1fa6a378cfad31addbe06cb03ded6ddd42b24e3ee8f86d70a7811f33949b129f962eebd50477fa46910604d3ca297b1ea4a8c570dd13ef0980a16399d6f673d6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 12f849f05b32297d460515edcac19a6b69be22ba6db39f112d65216c26409b09
MD5 f23139af82b9e82bc35ee779afe6b3a9
SHA1 f51f8828ab85669f5ec2eac3b66f0ec7e9623e57
SHA512 b9a843b09ac8f678b6f2335c85ba4db88128adb03b2ade722f41a2f4acc9a372164a45308d17f88ced1a5c7ebe0b37c5e79566d2e0434a5ef7dd01557f137eca
SSDEEP 96:nbkkW21GyEj0wpvWMoiVmdeHmQIq9UWQyV+VDCziEwb:nbkIIyEj0GWMXz9ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 00842d8cd0834fe26ec9d3957956b953728e369ec99084121b71d4a8fa1f2172
MD5 0194b7e5ca28133390aba6aecd529ead
SHA1 ca5c54822629417510963878b4f19899b91cd9de
SHA512 f5f351ef5dc15088c88f0df96b6731891c62d76bbb117c179729103c70ed59c85548ebea4e0a31023390152e72879fccd875d720dbde60e05a66d0e4d9ce5a0b
SSDEEP 96:nbkvW21Gycj0wpvWMoiVmde+z1FzEQqeYG2mQIq9UWQyV+VDCAiEwb:nbk5Iycj0GWMuz1FYQqeYG2z9rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 25ae07658ad0ca745a1fbea4686a94ce11554a04dc69075ce417f82a963480f8
MD5 67cedd6431f6571461f0deddd2c120be
SHA1 4d9e89f989f699111cf0f38f53da21808aec2208
SHA512 f32a236d0ac84ef8b90b3a842b2449294139897f58a8b44eed2216070fd485b64b70d7e58c8f44466ab829ac4f5ae2d63162514b5b180def7b17bbe06db32a8a
SSDEEP 96:nbkvW21GyEj0wpvWMoiVmdeVe2mQIq9UWQyV+VDCAiEwb:nbk5IyEj0GWMle2z9rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 39c542e0679b4f209084f3e0a29c5b399e52d11c2e6761088595c5c1e45fb7f1
MD5 dfe3db63af981c58bd98d3883e89e48b
SHA1 59d040bb705d190ba8be5e48368a6f9222d81061
SHA512 89ea6a81939edf9ab58f1c1c61404242ca2c846990913b206993fb348854dce4366799884cf2f719da406cf005db3982eef6fb62113a41093252853a9a19399c
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b73a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b73a.TMP
Size 707B
SHA256 44e104dc764d09085a7d830f7713deb3d4e77e0d4eb3f87c01b9f8e9fe57c363
MD5 50b462e00fdcfe28e0ced65b9b374bd9
SHA1 960743838a4343c2af2ec6994f1fe50f56dfdc7a
SHA512 d4c099e84381473ebf070906a28ab55a2cf95193e21a5afdf21b57b1d0df7022ae217b11d1d760a0fe461b16f900a6e1de397942e6119ad8accc6ad84fdd6bad
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0815167706d58f4c191979a0405ef3899cd3c9a7d6acfb33fdaf95615f5aefb5
MD5 19640fbcb69a580b08ea4a27657e290d
SHA1 a471ed947e38244c06a280e230d092b83e50814a
SHA512 34d4bbad432b06f6fd4757929e05be54a91faeb4af0cf9898f8e9b68acae2576b3a469542aac8095d691ae603f5a4210947b8d79d411c162eb15ab8b0d86371a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfpe2RUkIKbofYOxhZHnqTY:A9iIxuERzA83h09RZxYf9L2xTHqTMTLt
MD5 SHA1 SHA512 SSDEEP

Submit Download