930ce974b4ffd4d199bf640716dafb8586e49596d72dff0ceaf41867e6a67f9a

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b78bd6068c723100e471389aec01f51_JaffaCakes118.html
Size 145KB
Sample240601-xt9ktacb2w
SHA256 930ce974b4ffd4d199bf640716dafb8586e49596d72dff0ceaf41867e6a67f9a
MD5 8b78bd6068c723100e471389aec01f51
SHA1 1502a5bd610eb9f45d1be77cee0c6bbaa1cae415
SHA512 6a574cba6b3cfa32a4c5a7743851140dfd2a1ae452b66fbc03fb5137bfaba03c1fae904e4e5f34618e7cd4bccce12f9808a88a03c8a79fa2974880a230cbf5b0
SSDEEP 1536:Sy5+8exswp9Cqb8JVczVsEQIzVYlD64IDQR4fG+ethtp8TzE2ELdSh+WwXeWyFD6:S+wpcqb6VMsAzVYlD64V/Q+
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
43	pastebin.com
68	pastebin.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
3740	msedge.exe
3740	msedge.exe
2628	identity_helper.exe
2628	identity_helper.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 2284	3740	msedge.exe	84
PID 3740 wrote to memory of 2284	3740	msedge.exe	84
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 2508	3740	msedge.exe	85
PID 3740 wrote to memory of 4708	3740	msedge.exe	86
PID 3740 wrote to memory of 4708	3740	msedge.exe	86
PID 3740 wrote to memory of 3512	3740	msedge.exe	87
PID 3740 wrote to memory of 3512	3740	msedge.exe	87
PID 3740 wrote to memory of 3512	3740	msedge.exe	87
PID 3740 wrote to memory of 3512	3740	msedge.exe	87
PID 3740 wrote to memory of 3512	3740	msedge.exe	87
PID 3740 wrote to memory of 3512	3740	msedge.exe	87
PID 3740 wrote to memory of 3512	3740	msedge.exe	87
PID 3740 wrote to memory of 3512	3740	msedge.exe	87
PID 3740 wrote to memory of 3512	3740	msedge.exe	87
PID 3740 wrote to memory of 3512	3740	msedge.exe	87
PID 3740 wrote to memory of 3512	3740	msedge.exe	87
PID 3740 wrote to memory of 3512	3740	msedge.exe	87
PID 3740 wrote to memory of 3512	3740	msedge.exe	87
PID 3740 wrote to memory of 3512	3740	msedge.exe	87
PID 3740 wrote to memory of 3512	3740	msedge.exe	87
PID 3740 wrote to memory of 3512	3740	msedge.exe	87
PID 3740 wrote to memory of 3512	3740	msedge.exe	87
PID 3740 wrote to memory of 3512	3740	msedge.exe	87
PID 3740 wrote to memory of 3512	3740	msedge.exe	87
PID 3740 wrote to memory of 3512	3740	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8b78bd6068c723100e471389aec01f51_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9924846f8,0x7ff992484708,0x7ff992484718
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6062151558393655075,10307572840411937340,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,6062151558393655075,10307572840411937340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,6062151558393655075,10307572840411937340,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6062151558393655075,10307572840411937340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6062151558393655075,10307572840411937340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6062151558393655075,10307572840411937340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6062151558393655075,10307572840411937340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6062151558393655075,10307572840411937340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6062151558393655075,10307572840411937340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6062151558393655075,10307572840411937340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6062151558393655075,10307572840411937340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6062151558393655075,10307572840411937340,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5024 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 547B
SHA256 88947ea1885e99f26b3a47ef673a877bde165dfceb186d88a9207417086e43ec
MD5 cc426090b6414d81abe74ae7c05ed65d
SHA1 fadb0e647235a5d1b90c583c64fe21484c98d99d
SHA512 dfe71ab96261c865aad7d2c6ad49edd27368cd8f2dd27886cbfaaf438cd442de18feabbb40bc6f19e9594563c4c19e8a4384eb8b82fea2a903cd95535d911147
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 8bca413fe364ec1161a21999f2d34461621b7db135a70cf9d29964a9a7bd283c
MD5 8f71729959499f3433de2c17050c78cf
SHA1 a1bc28fabb04eeb2b7cb828533fb76f74185231d
SHA512 f2c97e46ee94ec25052347dadb8aef900d19d0262c8797c116283f1b527436c7d1ad20e2d00cfe2503d12961b99ede74c0846c7954dc58b466143b2d603faf11
SSDEEP 96:nePkRu417B72wpvWMoiVmdeHk4l1etUWQyV+VDCziEwb:nmkn9B72GWMXstro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 57f6b13be30ccf9d32eaa0c6bf3e0df7f2e20ab698728479d891d4034e2e61ef
MD5 aca57d7d42240feafb87cee0d9092690
SHA1 0dcba1c7c894b835a99573d13451ef9620009529
SHA512 53dda8179f2227b8095740cca44421071f60207f454fa8a3565494adca9a93a2c273549718a18fea6509f6969c89d3b3ecc81370f2baf7faf138248002a6f158
SSDEEP 96:nePk8u417B72wpvWMoiVmdeEZqk4l1etUWQyV+VD7AiEwb:nmk09B72GWMSqstrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5cb0609f4e8d6bd41e405438bd776e917dfe20c9a2dee11b58dcb82526c70b5b
MD5 13165f08a584b6941c5337e7e060f59a
SHA1 b9558b82567ba2f2db51f5e31741f45eed5f903e
SHA512 aab40f250f40d45ac37ab5170806f4a8e96004de62598e520040c6be1251a859bf3129d13a8fe52b17e3886269dbf778f55cb54be00c26919eec76ad3e4a49c3
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupU7Zge2RUWy4VR3z2OMDCR4:A9iIxuERzA83h09RZxYaIlRaOMWRHql1
MD5 SHA1 SHA512 SSDEEP

Submit Download