ecddb82ac6182657b8e9c854364f5f1fda5fc9de9c0f31a4d9e6545f292de544

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b7863c18aeeca869082fe445acea830_JaffaCakes118.html
Size 16KB
Sample240601-xty43sch22
SHA256 ecddb82ac6182657b8e9c854364f5f1fda5fc9de9c0f31a4d9e6545f292de544
MD5 8b7863c18aeeca869082fe445acea830
SHA1 ef1dfd07c59b03f8bfab56c1b91962c44cb9964b
SHA512 d6860620e3efbb33c574a3dd11344ec8e854a79d881d8128d42ac4cb186045633dd379f6ca5c6838fd42c6edeff43159880858b18ad1885a18ca4abc718c1c70
SSDEEP 384:vMOAK/qr2/N/lQeCiWmxobllI/BPEw1AD/tLtBLbWOeAUmkdC69:tDSr2VNQxlVRtxWOeAUmkdC69
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3444	msedge.exe
3444	msedge.exe
3084	identity_helper.exe
3084	identity_helper.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 3860	3444	msedge.exe	81
PID 3444 wrote to memory of 3860	3444	msedge.exe	81
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3656	3444	msedge.exe	82
PID 3444 wrote to memory of 3736	3444	msedge.exe	83
PID 3444 wrote to memory of 3736	3444	msedge.exe	83
PID 3444 wrote to memory of 2072	3444	msedge.exe	84
PID 3444 wrote to memory of 2072	3444	msedge.exe	84
PID 3444 wrote to memory of 2072	3444	msedge.exe	84
PID 3444 wrote to memory of 2072	3444	msedge.exe	84
PID 3444 wrote to memory of 2072	3444	msedge.exe	84
PID 3444 wrote to memory of 2072	3444	msedge.exe	84
PID 3444 wrote to memory of 2072	3444	msedge.exe	84
PID 3444 wrote to memory of 2072	3444	msedge.exe	84
PID 3444 wrote to memory of 2072	3444	msedge.exe	84
PID 3444 wrote to memory of 2072	3444	msedge.exe	84
PID 3444 wrote to memory of 2072	3444	msedge.exe	84
PID 3444 wrote to memory of 2072	3444	msedge.exe	84
PID 3444 wrote to memory of 2072	3444	msedge.exe	84
PID 3444 wrote to memory of 2072	3444	msedge.exe	84
PID 3444 wrote to memory of 2072	3444	msedge.exe	84
PID 3444 wrote to memory of 2072	3444	msedge.exe	84
PID 3444 wrote to memory of 2072	3444	msedge.exe	84
PID 3444 wrote to memory of 2072	3444	msedge.exe	84
PID 3444 wrote to memory of 2072	3444	msedge.exe	84
PID 3444 wrote to memory of 2072	3444	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8b7863c18aeeca869082fe445acea830_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9d0c46f8,0x7ffd9d0c4708,0x7ffd9d0c4718
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14921208361574138883,3670922843036362956,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,14921208361574138883,3670922843036362956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,14921208361574138883,3670922843036362956,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14921208361574138883,3670922843036362956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14921208361574138883,3670922843036362956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14921208361574138883,3670922843036362956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14921208361574138883,3670922843036362956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14921208361574138883,3670922843036362956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14921208361574138883,3670922843036362956,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14921208361574138883,3670922843036362956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14921208361574138883,3670922843036362956,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14921208361574138883,3670922843036362956,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 3a388f6f3458566865490e0e00d78f25a5b8b63f5c1f525aeeaa6fd06b8b2857
MD5 b33b0bc6f1b2071605a3ad46ecade173
SHA1 9bd5452fb4f0c6632695431acde8a16c7e331b94
SHA512 dbc78487327b04ec96b7cdf3861c44d725174b25310c6eaadd1b8db7f9b375a3f68ae652ca6befbd5dfcf9973b3f70b2682409057c4d78d77f4311d84b2f6403
SSDEEP 96:nIkO7B1mCga9IQwpvWMoiVmdeHpCrEbNUWQyV+VDCziEwb:nIkewRaCQGWMXpHbNro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9fd0c23c1eb99c5fb0341653d54257ad5433d344e4ccc0ac77c6986dde31f182
MD5 3c56bd7c5ef02e6bb6ad75c442abdca0
SHA1 c98e436904d2fcc9a70058b062f7462acf584b15
SHA512 3f8ec4df65333f228ef3f2c902c118f2087855787074d6b02075a5e4c0fd43f4a13d38be83b3597253d2527c953c9c372226e7b5f34d4e8e03c7f1f29acdeb28
SSDEEP 96:nIkF7B1maga9IQwpvWMoiVmdeHpCrEbNUWQyV+VD7AiEwb:nIkjwJaCQGWMXpHbNrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a85460a58234eb17ac35a091d0f524c4372729f16bd5a915f1afaf66e93552a6
MD5 05047c2aa3a371c71ce30310b7c63960
SHA1 77f2e637e714c8d70bf81d6ee974ac7abc2e1146
SHA512 56840b39f3a5b9fa1ffae3e10b54e9d5dec0ec88df8bac1cc18cfa801c30ca61e61f79b455ba08f276f10480c7957a79c9f8a69eb3e31121cc3abca8eec1f44a
SSDEEP 96:nIkF7B1mCga9IQwpvWMoiVmdeHpCrEbNUWQyV+VDCAiEwb:nIkjwRaCQGWMXpHbNrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 4a9c1722b816fba42abd5e37596febc96f4a986e240f56159ca49dd8799c7816
MD5 4f5fc9b545e6a63bd6d42660cf0e8ce7
SHA1 c7336440ed1e0c6cc866e9603f14432fbef9fa17
SHA512 613cee7195ade6e26b166fcd77439eb23fbef7ce5db11ef6eab85e0613e30f21f97e3205b5a25fcee9721076987ab254399d51a57f5c8fa68d9c847b615c633a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup3k7e2RU7gjf7Zb3z2OMDCJ:A9iIxuERzA83h09RZxY3krMUzZbaOMWJ
MD5 SHA1 SHA512 SSDEEP

Submit Download