41e256c8571bbb564f5b09a9ffb9d4ca0812508270245990c07d88973b5277e8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b981a792883d99f88e5c0451aa7aa7e_JaffaCakes118.html
Size 129KB
Sample240601-yn17xseb46
SHA256 41e256c8571bbb564f5b09a9ffb9d4ca0812508270245990c07d88973b5277e8
MD5 8b981a792883d99f88e5c0451aa7aa7e
SHA1 4075547d64f527585665a01b2264b5a03c5e5923
SHA512 7a6be0c516bf6957f23e8095640cc72b831a42e92db73e7aa0b9e1b434ae1feb32bc03d3c184990b10652e262e7cd2cabf2e0c958218d9dd3e8e793eabb2ab94
SSDEEP 3072:r/wZ85AUuaLYUAFsyYtRvRoX68o1gFwhm/NuFGrXmfpx89DVQvwRAMWEyR889DyI:r/wZ85AUuaLYUAFsyYtFgChmwFGkx89W
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
948	msedge.exe
948	msedge.exe
2240	msedge.exe
2240	msedge.exe
4308	identity_helper.exe
4308	identity_helper.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1616	2240	msedge.exe	81
PID 2240 wrote to memory of 1616	2240	msedge.exe	81
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 2884	2240	msedge.exe	82
PID 2240 wrote to memory of 948	2240	msedge.exe	83
PID 2240 wrote to memory of 948	2240	msedge.exe	83
PID 2240 wrote to memory of 3152	2240	msedge.exe	84
PID 2240 wrote to memory of 3152	2240	msedge.exe	84
PID 2240 wrote to memory of 3152	2240	msedge.exe	84
PID 2240 wrote to memory of 3152	2240	msedge.exe	84
PID 2240 wrote to memory of 3152	2240	msedge.exe	84
PID 2240 wrote to memory of 3152	2240	msedge.exe	84
PID 2240 wrote to memory of 3152	2240	msedge.exe	84
PID 2240 wrote to memory of 3152	2240	msedge.exe	84
PID 2240 wrote to memory of 3152	2240	msedge.exe	84
PID 2240 wrote to memory of 3152	2240	msedge.exe	84
PID 2240 wrote to memory of 3152	2240	msedge.exe	84
PID 2240 wrote to memory of 3152	2240	msedge.exe	84
PID 2240 wrote to memory of 3152	2240	msedge.exe	84
PID 2240 wrote to memory of 3152	2240	msedge.exe	84
PID 2240 wrote to memory of 3152	2240	msedge.exe	84
PID 2240 wrote to memory of 3152	2240	msedge.exe	84
PID 2240 wrote to memory of 3152	2240	msedge.exe	84
PID 2240 wrote to memory of 3152	2240	msedge.exe	84
PID 2240 wrote to memory of 3152	2240	msedge.exe	84
PID 2240 wrote to memory of 3152	2240	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8b981a792883d99f88e5c0451aa7aa7e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ff8f56546f8,0x7ff8f5654708,0x7ff8f5654718
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13489500409830495178,13293644136435674042,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,13489500409830495178,13293644136435674042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,13489500409830495178,13293644136435674042,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13489500409830495178,13293644136435674042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13489500409830495178,13293644136435674042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13489500409830495178,13293644136435674042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13489500409830495178,13293644136435674042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13489500409830495178,13293644136435674042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13489500409830495178,13293644136435674042,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13489500409830495178,13293644136435674042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13489500409830495178,13293644136435674042,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13489500409830495178,13293644136435674042,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
MD5 4f7152bc5a1a715ef481e37d1c791959
SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
MD5 ea98e583ad99df195d29aa066204ab56
SHA1 f89398664af0179641aa0138b337097b617cb2db
SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 947B
SHA256 a98ba6e7bc7a3c69c319d533f3323b5f7e68a76143691f26c531ea611ff3676d
MD5 6cffc2c3516885c37fbf42272717ef05
SHA1 98eca56ef36bb948c3e5104bc11dd11e77523fd0
SHA512 48f93820868462754f29b428a711f352bff11915152ec8119e1b4a80050738ab2ef92056aa8cb39338703d2a6b374c31f0e7f38065116532cbd87635ce44a6dd
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 8fc0e00c9d0e00f3e5e6d39f7a73178a0a0a8b464033bc778444752c9f9462a8
MD5 f09e8274fc6eefe42d59364fef543a87
SHA1 ba8a873527ca58edca6d4b2ccabc23d7d6cc8c4a
SHA512 643c8a175e47f6421ba0c38d3482a5336ad0d5f34b5a3d5f2c811d2debd67790ffa0c1722e4604538e6b1730c7902afd47ba321b296d3f5c9989fe6c1d9de2a6
SSDEEP 96:n/pFkIPp91V73XwpvWMoiVmdeHp1kcTU7YAUWQyV+VDCziEwb:nHkOXzXGWMXpd4dro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 28cc6a8fca8b6e522163055640c0ffafcb47d15696657760ff77750489c47b29
MD5 e999294701cba600e1e299a8c34335bd
SHA1 06fd14a607aa3397366a8b4604a4142d8fe039ca
SHA512 c2471776a7946db4d4a1d9c48dca47e98f5f9f72f5c152b70d78c827a053488ce65384beda3b8cec009e88e348bf63f570e4e9a99987491bc63f7a5a8dda0803
SSDEEP 96:n/pFkjPp91Vj3XwpvWMoiVmdeHp1kcTU7YAUWQyV+VDCAiEwb:nHkvXrXGWMXpd4drV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 ceaf732d8abaef789783e389b6d9ae183a571f153df3dcc926f7d14e41f59446
MD5 e46a67192d32a15b93555fba8be9816e
SHA1 c4c99352c6fd1934c4939a5c9b2074101f4ff17a
SHA512 aef9588ffb73e3a741c72dffa0b3799958ee71d19727b899b2c0c2a2681cd618c96e605ba80e3fc69385b92fc8b07765cb48f7dcbc0899290471bfa95c2b9492
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupt7De2RUSko5S3z2OMDCRHL:A9iIxuERzA83h09RZxYtvXbSaOMWRHqq
MD5 SHA1 SHA512 SSDEEP

Submit Download