980889b7e60bd7ab1828993546594188753141f0b7cde92791cbb99e75095d46

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8466ed3dcb51e2f366a53e439e0a321a_JaffaCakes118.html
Size 27KB
Sample240530-rcxa9scb59
SHA256 980889b7e60bd7ab1828993546594188753141f0b7cde92791cbb99e75095d46
MD5 8466ed3dcb51e2f366a53e439e0a321a
SHA1 71e67cb48ab0f2a760a93058c71c2ee0aaff75be
SHA512 954118796266a35ef0403b5126b278513902ed408427a309be6077a3661a551e7d0153b550d55aea6632d6bbf6138b6dc95d638809dba67be607587c5c0de189
SSDEEP 768:5x8NLq3AoXVY8u0Gr6eA/mezGmruNb5nme1ZfXcVkW/oeIL3:5x8NLq3AoXVY8u0Gr6eYtonTfXcVV/on
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
3080	msedge.exe
3080	msedge.exe
4788	identity_helper.exe
4788	identity_helper.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 2116	3080	msedge.exe	85
PID 3080 wrote to memory of 2116	3080	msedge.exe	85
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 3500	3080	msedge.exe	86
PID 3080 wrote to memory of 2948	3080	msedge.exe	87
PID 3080 wrote to memory of 2948	3080	msedge.exe	87
PID 3080 wrote to memory of 4264	3080	msedge.exe	88
PID 3080 wrote to memory of 4264	3080	msedge.exe	88
PID 3080 wrote to memory of 4264	3080	msedge.exe	88
PID 3080 wrote to memory of 4264	3080	msedge.exe	88
PID 3080 wrote to memory of 4264	3080	msedge.exe	88
PID 3080 wrote to memory of 4264	3080	msedge.exe	88
PID 3080 wrote to memory of 4264	3080	msedge.exe	88
PID 3080 wrote to memory of 4264	3080	msedge.exe	88
PID 3080 wrote to memory of 4264	3080	msedge.exe	88
PID 3080 wrote to memory of 4264	3080	msedge.exe	88
PID 3080 wrote to memory of 4264	3080	msedge.exe	88
PID 3080 wrote to memory of 4264	3080	msedge.exe	88
PID 3080 wrote to memory of 4264	3080	msedge.exe	88
PID 3080 wrote to memory of 4264	3080	msedge.exe	88
PID 3080 wrote to memory of 4264	3080	msedge.exe	88
PID 3080 wrote to memory of 4264	3080	msedge.exe	88
PID 3080 wrote to memory of 4264	3080	msedge.exe	88
PID 3080 wrote to memory of 4264	3080	msedge.exe	88
PID 3080 wrote to memory of 4264	3080	msedge.exe	88
PID 3080 wrote to memory of 4264	3080	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8466ed3dcb51e2f366a53e439e0a321a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9aa2a46f8,0x7ff9aa2a4708,0x7ff9aa2a4718
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,120658615008922901,324421883529907679,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,120658615008922901,324421883529907679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,120658615008922901,324421883529907679,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,120658615008922901,324421883529907679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,120658615008922901,324421883529907679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,120658615008922901,324421883529907679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,120658615008922901,324421883529907679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,120658615008922901,324421883529907679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,120658615008922901,324421883529907679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,120658615008922901,324421883529907679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,120658615008922901,324421883529907679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,120658615008922901,324421883529907679,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E0F5C59F9FA661F6F4C50B87FEF3A15A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
Size 893B
SHA256 a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7
MD5 d4ae187b4574036c2d76b6df8a8c1a30
SHA1 b06f409fa14bab33cbaf4a37811b8740b624d9e5
SHA512 1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
MD5 87f7abeb82600e1e640b843ad50fe0a1
SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1015B
SHA256 09297772cbd47d6e035f47de7d7bc1a9e061fad8fb5e112eab34b4c2218a2484
MD5 25bfbc3ea0b33b09b63a1ab876692eba
SHA1 3c16f4b0551205a3b35226dfce8e5fbe3dfed472
SHA512 6448c39a8db637e86dabb9f63b5b1a1a2575ec4b73175efcbb62b751c67f4e923c0dd80efd42cb744fa0159040e075b1d1af19f1a0ff17e7f1b3f801da26069b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f149b4a64ffb9543abf12295c4e1d5ec9c5aab24d85af27f8abac572319c829b
MD5 17cb3e17d6d48d6270ffe82fb655308a
SHA1 2777b6857cd123d64eb5cfdb74974f596da3e7d1
SHA512 a1adae9b9f79736eb0d17694d4b4e94217ba33a4d561d5b5997dcdfd79331dd330f5e2e2cfc8fcc1a7ea350102679473c8effbc018eadb077c199cabe47e07a6
SSDEEP 96:n/k8MT1mDS0wpvWMoiVmdeH/z5AqUWQyV+VD7AiEwb:n/kVTAhGWMXWqrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

d2bb649d-e0c5-47ad-896f-f27ab25cd1b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d2bb649d-e0c5-47ad-896f-f27ab25cd1b1.tmp
Size 5KB
SHA256 8cc7fd14afe55342ebfb4e414172c5b6d8bc87d8db8e2617d2409dcb4a4899e4
MD5 c4c8417a5466b986487628fd7e5b2715
SHA1 2c61116638adb6125aa08de92375f96573b14d0e
SHA512 2b6b60f6d5ed8f2c67941af8db0a3853a5ba0bc0f3bef9495d0be3a84d49a3ee36de455d7ffabe9cce2022bac7a54e9e7d563ec16a83c884600181b44b68b7a7
SSDEEP 96:n/kRMT1mDv0wpvWMoiVmdeH/z5AqUWQyV+VDCziEwb:n/kWTA8GWMXWqro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 9089d275104431aef329efe2f354d7a60ef8809e55d538afdad68acf652f32f6
MD5 c4903b15d12f2e0b2cc8a923c056de3a
SHA1 b48f16c50031bc8f5c1c578aebfffd44a6d8793b
SHA512 cd3f09f3e5b3103890d06bd931770b9a3ea3cefe7d4e55d37b9f7572aa3bbdaaebf8e05bc23240603c6f5b19dbfb0781a6feba9fd40f6467a366b755e4774854
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupxvLFe2RUcmyB3z2OMDCRHk:A9iIxuERzA83h09RZxY195BaOMWRHqlV
MD5 SHA1 SHA512 SSDEEP

Submit Download