a74dab42c65412f3ff134f8cfbd9fb2843a00483f48f6c500664ffac85cfa157

Analysis

max time kernel
145s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8a38c3ed6bc319fc5543312f691be169_JaffaCakes118.html
Size 348KB
Sample240601-mrnkfsbb36
SHA256 a74dab42c65412f3ff134f8cfbd9fb2843a00483f48f6c500664ffac85cfa157
MD5 8a38c3ed6bc319fc5543312f691be169
SHA1 e85c2ce7792cbc35e8a19507952e629af871408c
SHA512 fd03b8c17842663c426dfcc9cdfda4aa28d138f374c16131bb9242638d91c893734e09b08483f2b0ad4707a72e2d7836805687a76b2b57493687aaa580902c2d
SSDEEP 6144:XsMYod+X3oI+YbsMYod+X3oI+Y5sMYod+X3oI+YQ:75d+X3p5d+X3f5d+X3+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
380	msedge.exe
380	msedge.exe
3424	msedge.exe
3424	msedge.exe
4780	identity_helper.exe
4780	identity_helper.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 2908	3424	msedge.exe	81
PID 3424 wrote to memory of 2908	3424	msedge.exe	81
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 2180	3424	msedge.exe	83
PID 3424 wrote to memory of 380	3424	msedge.exe	84
PID 3424 wrote to memory of 380	3424	msedge.exe	84
PID 3424 wrote to memory of 1972	3424	msedge.exe	85
PID 3424 wrote to memory of 1972	3424	msedge.exe	85
PID 3424 wrote to memory of 1972	3424	msedge.exe	85
PID 3424 wrote to memory of 1972	3424	msedge.exe	85
PID 3424 wrote to memory of 1972	3424	msedge.exe	85
PID 3424 wrote to memory of 1972	3424	msedge.exe	85
PID 3424 wrote to memory of 1972	3424	msedge.exe	85
PID 3424 wrote to memory of 1972	3424	msedge.exe	85
PID 3424 wrote to memory of 1972	3424	msedge.exe	85
PID 3424 wrote to memory of 1972	3424	msedge.exe	85
PID 3424 wrote to memory of 1972	3424	msedge.exe	85
PID 3424 wrote to memory of 1972	3424	msedge.exe	85
PID 3424 wrote to memory of 1972	3424	msedge.exe	85
PID 3424 wrote to memory of 1972	3424	msedge.exe	85
PID 3424 wrote to memory of 1972	3424	msedge.exe	85
PID 3424 wrote to memory of 1972	3424	msedge.exe	85
PID 3424 wrote to memory of 1972	3424	msedge.exe	85
PID 3424 wrote to memory of 1972	3424	msedge.exe	85
PID 3424 wrote to memory of 1972	3424	msedge.exe	85
PID 3424 wrote to memory of 1972	3424	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8a38c3ed6bc319fc5543312f691be169_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffea93746f8,0x7ffea9374708,0x7ffea9374718
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,6924374185309100312,8222655912734189129,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,6924374185309100312,8222655912734189129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,6924374185309100312,8222655912734189129,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6924374185309100312,8222655912734189129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6924374185309100312,8222655912734189129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,6924374185309100312,8222655912734189129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,6924374185309100312,8222655912734189129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6924374185309100312,8222655912734189129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6924374185309100312,8222655912734189129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6924374185309100312,8222655912734189129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6924374185309100312,8222655912734189129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,6924374185309100312,8222655912734189129,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
MD5 4f7152bc5a1a715ef481e37d1c791959
SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
MD5 ea98e583ad99df195d29aa066204ab56
SHA1 f89398664af0179641aa0138b337097b617cb2db
SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 384e54245bb8fb37bfe582858271b2b981b17a817507273c9e93486b78bea501
MD5 23c0562545fb27b7de76675fa2b42e0d
SHA1 7df51c81ee4cd070c7fd49b598a22670d19563ed
SHA512 d181ec7f88a18803baaf8e1b8889e12bc7e14143a1537f7755896974ebb667d96deb4d362529fbddabc8f9eeb28c9392d557d4728c4db779bb94c2582b9d3437
SSDEEP 96:nYOkMoN1533XwpvWMoiVmdeHp1kcEUWQyV+VDCziEwb:nxkrPnXGWMXppEro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ff341f77010013bb5841450d3cdd97e589021c7649bc70ad1157fedccb5f2ef4
MD5 20adc328273d6c10458a055310dc8195
SHA1 54abdcfc529e1d9f870ad169640a552036a9ea0f
SHA512 434054d2b519b689636c404a1d32cf89eb4be37b67548b2ba63b52c6fd587bcefd5c0e316e3c7d8d6f24f8df70f39d07e845067aecdc8bfb10ab3a8138bbb078
SSDEEP 96:nYOk3oN15U3XwpvWMoiVmdeHp1kcEUWQyV+VD7AiEwb:nxkePAXGWMXppErg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 94acc8d5f4dfc56047084b4ad5a68b94dcd5814faac163d0708b206b41975a4a
MD5 5789a2dfabee0710b4289610117ef625
SHA1 58539608846370a2ffd3fb235e13ed19089c3c74
SHA512 1ff38e677ef681d54c1c423b54f79a8751b3be1c43e93d4c6a16ae86bd1493abfbbb9e2c4bd2e6dbc6dee6797893091d6ad47549d39cfc43039cc3e16d600f30
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup8K7ie2RUpo5y3z2OMDCRHI:A9iIxuERzA83h09RZxY8KwJyaOMWRHq9
MD5 SHA1 SHA512 SSDEEP

Submit Download