d34972db9fc3e69700b0de65b01d5e7e5fb0c0476733b8700389a4f07987a9ba

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 02:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
85bcf5b24b512b71e032479b3dc26f52_JaffaCakes118.html
Size 32KB
Sample240531-cym76ada84
SHA256 d34972db9fc3e69700b0de65b01d5e7e5fb0c0476733b8700389a4f07987a9ba
MD5 85bcf5b24b512b71e032479b3dc26f52
SHA1 45611f1f0f91258c072f888bef4cee429636378b
SHA512 82cd1baa04c15cf48d92c2a6a40586ff7cc69cd0c32f8970a767676a983f053a681cc58adae161fab133a6d7dd07c3bd812575f44f1c09ea862af8103456ffdf
SSDEEP 768:I+Xah33M4NZow5Fg4cfMoufc2o7sTO+HlHWQ3Wj91AsNyiwMo94:I+Xah33M4NZow5Fg4cfMoufcQTO+HtRi
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
1588	msedge.exe
1588	msedge.exe
4668	identity_helper.exe
4668	identity_helper.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 3264	1588	msedge.exe	82
PID 1588 wrote to memory of 3264	1588	msedge.exe	82
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4664	1588	msedge.exe	83
PID 1588 wrote to memory of 4936	1588	msedge.exe	84
PID 1588 wrote to memory of 4936	1588	msedge.exe	84
PID 1588 wrote to memory of 804	1588	msedge.exe	85
PID 1588 wrote to memory of 804	1588	msedge.exe	85
PID 1588 wrote to memory of 804	1588	msedge.exe	85
PID 1588 wrote to memory of 804	1588	msedge.exe	85
PID 1588 wrote to memory of 804	1588	msedge.exe	85
PID 1588 wrote to memory of 804	1588	msedge.exe	85
PID 1588 wrote to memory of 804	1588	msedge.exe	85
PID 1588 wrote to memory of 804	1588	msedge.exe	85
PID 1588 wrote to memory of 804	1588	msedge.exe	85
PID 1588 wrote to memory of 804	1588	msedge.exe	85
PID 1588 wrote to memory of 804	1588	msedge.exe	85
PID 1588 wrote to memory of 804	1588	msedge.exe	85
PID 1588 wrote to memory of 804	1588	msedge.exe	85
PID 1588 wrote to memory of 804	1588	msedge.exe	85
PID 1588 wrote to memory of 804	1588	msedge.exe	85
PID 1588 wrote to memory of 804	1588	msedge.exe	85
PID 1588 wrote to memory of 804	1588	msedge.exe	85
PID 1588 wrote to memory of 804	1588	msedge.exe	85
PID 1588 wrote to memory of 804	1588	msedge.exe	85
PID 1588 wrote to memory of 804	1588	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\85bcf5b24b512b71e032479b3dc26f52_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff86ae746f8,0x7ff86ae74708,0x7ff86ae74718
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,8484514028519893136,1274428494197550210,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,8484514028519893136,1274428494197550210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,8484514028519893136,1274428494197550210,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,8484514028519893136,1274428494197550210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,8484514028519893136,1274428494197550210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,8484514028519893136,1274428494197550210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2648 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,8484514028519893136,1274428494197550210,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,8484514028519893136,1274428494197550210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,8484514028519893136,1274428494197550210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,8484514028519893136,1274428494197550210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,8484514028519893136,1274428494197550210,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,8484514028519893136,1274428494197550210,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3180 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 182B
SHA256 ecb5860418331ce7b5253419ebab9fb495ab9dba26b7d0751699949555074372
MD5 5fba847350341dc385c90bbd14b812f4
SHA1 986d1713b103f3d565ccb88077a8598c8393a24e
SHA512 227478553cd394c0ae057d78160c461119d7418765a14ab55ac18daec588ef8883c09c931adc149f380fead0a6e0e92cb0d6d8c29c27cacd63143b615b23e830
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ec4c2700f2846dc59a0705d0533e6c037623ff5ae5f4f42c2b13311efb3e2f32
MD5 54b85b3f96bae13635f1b8ffbd5449a8
SHA1 6cdd8c2d2072697a7d80793466f2dd0369fe309a
SHA512 e94b7c2f395e3b089c2d18942db34ff1f65676a07acc9fe8c38345cf403c9f09f5dafbf3e29d619ec524484912c8a326e85ff7a82db369e2b0824623ccfdf27a
SSDEEP 96:nhVkfxA1ZgjuwpvWMoiVmdeHvSSqDAEFDHUWQyV+VDCziEwb:n3k6XgjuGWMXYAEFrro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 00776e614914d05d1d8626d5149bf917d8a1b8f5656c044fb7e5de8fcc81f3f5
MD5 638056d892a63e71d8f05d2092926c86
SHA1 8d6b0fc5ebb76c85d2781823713bd9795395c520
SHA512 a728c3fc4627e2e7ab70e060d8dd7de9122016fdc7a0db4e33e699f91ae07e169448005b944649a077ce5208d77ab0841835ba7d2feadcecb74a42f4dca4a32b
SSDEEP 96:nhVkWxA1ZwjuwpvWMoiVmdetPVCJqvSSqDAEFDHUWQyV+VDCAiEwb:n3k1XwjuGWMtuqYAEFrrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 46d6470bffbe63a9bd306c1e2664a86c352600d9a26cf068f3341a0e0c50391b
MD5 de22b55ccea5a22a72ceff799d878d69
SHA1 4078e45dfaf8601f5a9ef15ca155203006c29e17
SHA512 719c34016e8f21418a5b398ee798e4748d2c7587bdca09e77a5ace1758ba99fe71a4bd3a9cc8f1d0cd6ae5921c85c7fbca0c8a571f9662a68c3ea15f9c722f31
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupXoe2RUdjRu33z2OMDCRHqR:A9iIxuERzA83h09RZxYXGT3aOMWRHqlf
MD5 SHA1 SHA512 SSDEEP

Submit Download