a5ef31f4d818a347f359c9002ab34c89d544d57040a0eaeae27a1514fbb2a32b

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8470cf7cfc3deed3e9a4aefcc85e10ce_JaffaCakes118.html
Size 36KB
Sample240530-rl1eaabd2y
SHA256 a5ef31f4d818a347f359c9002ab34c89d544d57040a0eaeae27a1514fbb2a32b
MD5 8470cf7cfc3deed3e9a4aefcc85e10ce
SHA1 7f2d97264363f8f50ae1c1e8c1ee7a72af078e86
SHA512 c92c9e6240ce42f3a27762bc103776e48d45f054efa9ef55860205069e803f55b72100095221ba631f76d998ca6927d86b8ca6f51eeddb6137ee3c46d3ebb428
SSDEEP 768:zwx/MDTH4i88hARjFZPXQE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6ThZOg6f9U56lL7:Q/TbJxNVNufSM/P8kK
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
2424	msedge.exe
2424	msedge.exe
364	identity_helper.exe
364	identity_helper.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 4104	2424	msedge.exe	83
PID 2424 wrote to memory of 4104	2424	msedge.exe	83
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 3864	2424	msedge.exe	84
PID 2424 wrote to memory of 4472	2424	msedge.exe	85
PID 2424 wrote to memory of 4472	2424	msedge.exe	85
PID 2424 wrote to memory of 2248	2424	msedge.exe	86
PID 2424 wrote to memory of 2248	2424	msedge.exe	86
PID 2424 wrote to memory of 2248	2424	msedge.exe	86
PID 2424 wrote to memory of 2248	2424	msedge.exe	86
PID 2424 wrote to memory of 2248	2424	msedge.exe	86
PID 2424 wrote to memory of 2248	2424	msedge.exe	86
PID 2424 wrote to memory of 2248	2424	msedge.exe	86
PID 2424 wrote to memory of 2248	2424	msedge.exe	86
PID 2424 wrote to memory of 2248	2424	msedge.exe	86
PID 2424 wrote to memory of 2248	2424	msedge.exe	86
PID 2424 wrote to memory of 2248	2424	msedge.exe	86
PID 2424 wrote to memory of 2248	2424	msedge.exe	86
PID 2424 wrote to memory of 2248	2424	msedge.exe	86
PID 2424 wrote to memory of 2248	2424	msedge.exe	86
PID 2424 wrote to memory of 2248	2424	msedge.exe	86
PID 2424 wrote to memory of 2248	2424	msedge.exe	86
PID 2424 wrote to memory of 2248	2424	msedge.exe	86
PID 2424 wrote to memory of 2248	2424	msedge.exe	86
PID 2424 wrote to memory of 2248	2424	msedge.exe	86
PID 2424 wrote to memory of 2248	2424	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8470cf7cfc3deed3e9a4aefcc85e10ce_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef86946f8,0x7ffef8694708,0x7ffef8694718
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,16785427203347932734,4378311556458293923,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,16785427203347932734,4378311556458293923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,16785427203347932734,4378311556458293923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16785427203347932734,4378311556458293923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16785427203347932734,4378311556458293923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,16785427203347932734,4378311556458293923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,16785427203347932734,4378311556458293923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16785427203347932734,4378311556458293923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16785427203347932734,4378311556458293923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16785427203347932734,4378311556458293923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16785427203347932734,4378311556458293923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,16785427203347932734,4378311556458293923,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
MD5 87f7abeb82600e1e640b843ad50fe0a1
SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 614B
SHA256 103b5b5d6f7a7c42fef5ed545ff4dc313a13e1841b64ec5c372faff7af383b6d
MD5 bca107cac5ef991a89afecf0e3425b46
SHA1 adfd0f97203d6c4da01c2e4fbe79e47397a39374
SHA512 8b91b9766f9ece3ff69a728db2ecad6886490a4dae822404085189fbc2bf693c897e19c519f6fb8743e8fd27961c883d53cb4f93373ecd85368f94dea017cb3b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 3b7778736a0d6af5abf66a977dc938957011279d7a8bd2997d6d508f12724e03
MD5 ce7e3551c40975c35310a1f9ec7d6fb0
SHA1 a98cf09a27d2a9b6058a6545a73ce957f1304fa4
SHA512 ed2459395f6d64f53ab3d1185b8655605a1ad0e7109db5d318f3c9142ddfbcf776dc1792a8b192bfd508ff0a0b7d5beeaa4ae9481eda53467ad09100cc945ad0
SSDEEP 96:nBLkfR112QyT0wpvWMoiVmdeH/zat2eUWQyV+VDCziEwb:nRkzMgGWMXgro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 534b6520a19835288fd25b7d9e1a051911c53299ee43eb6b2f72a9df58bd9915
MD5 13d53f08fd4e16f29efd3ace7f8e3162
SHA1 47dfa088a9d3078cf854edd7e812641840a6e3fe
SHA512 fb000c3bf77a4c019b6c03f3ef59a9bb1df9c440608ab2080998f3a3fad357f66cb05b25de945c0310e0c4790ac565745304b47c7bdd43b45485ede95c1ed9c0
SSDEEP 96:nBLkWR112QyD0wpvWMoiVmdeEiqyXIW2/zat2eUWQyV+VD7AiEwb:nRk8MwGWMwGF2grg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 80d723b0a69d48f8c37e60881d0c6e4189dbbee1b933a6e24627f269e7214166
MD5 f791c3cbfa2879f72d732ac84a0ce899
SHA1 2c529b3d6e033113f9da24a462788daa26a76c0b
SHA512 11218e527639cbdce685f081a55101dfdf031b7b1795a6e6b94d179c435cb7f6ff76aa2e449d912ea039296c72d251ce8799d7af1579595e0c71ed592306ebe9
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZv2e2RUwmyQ3z2OMDCRHq5:A9iIxuERzA83h09RZxYtYDQaOMWRHqlP
MD5 SHA1 SHA512 SSDEEP

Submit Download