a40d49f764434b2ff92c7303a3d5b245dea019ede1c8a7edb13072dac39b0156

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8fa51b38861385c84d60643dce84c3f5_JaffaCakes118.html
Size 67KB
Sample240602-2cl6eahc3v
SHA256 a40d49f764434b2ff92c7303a3d5b245dea019ede1c8a7edb13072dac39b0156
MD5 8fa51b38861385c84d60643dce84c3f5
SHA1 dec1447d8fda97afa310659cfd98f0e67e61e7dc
SHA512 1f705470e7372c5ef4b9a430250094b86313da347b11326f81914ae7bb807d881e3aa11c5008672c166f8432b6d549c20bb2f4a7d3b3356a201f8c4aa5b6adb2
SSDEEP 768:JilgcMiR3sI2PDDnX0g6sY6deoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8sM:Jh/TzNen0tbrga94hcuNnQC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1832	msedge.exe
1832	msedge.exe
2604	msedge.exe
2604	msedge.exe
3104	identity_helper.exe
3104	identity_helper.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2588	2604	msedge.exe	83
PID 2604 wrote to memory of 2588	2604	msedge.exe	83
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1624	2604	msedge.exe	84
PID 2604 wrote to memory of 1832	2604	msedge.exe	85
PID 2604 wrote to memory of 1832	2604	msedge.exe	85
PID 2604 wrote to memory of 3984	2604	msedge.exe	86
PID 2604 wrote to memory of 3984	2604	msedge.exe	86
PID 2604 wrote to memory of 3984	2604	msedge.exe	86
PID 2604 wrote to memory of 3984	2604	msedge.exe	86
PID 2604 wrote to memory of 3984	2604	msedge.exe	86
PID 2604 wrote to memory of 3984	2604	msedge.exe	86
PID 2604 wrote to memory of 3984	2604	msedge.exe	86
PID 2604 wrote to memory of 3984	2604	msedge.exe	86
PID 2604 wrote to memory of 3984	2604	msedge.exe	86
PID 2604 wrote to memory of 3984	2604	msedge.exe	86
PID 2604 wrote to memory of 3984	2604	msedge.exe	86
PID 2604 wrote to memory of 3984	2604	msedge.exe	86
PID 2604 wrote to memory of 3984	2604	msedge.exe	86
PID 2604 wrote to memory of 3984	2604	msedge.exe	86
PID 2604 wrote to memory of 3984	2604	msedge.exe	86
PID 2604 wrote to memory of 3984	2604	msedge.exe	86
PID 2604 wrote to memory of 3984	2604	msedge.exe	86
PID 2604 wrote to memory of 3984	2604	msedge.exe	86
PID 2604 wrote to memory of 3984	2604	msedge.exe	86
PID 2604 wrote to memory of 3984	2604	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8fa51b38861385c84d60643dce84c3f5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffca1246f8,0x7fffca124708,0x7fffca124718
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1508,14723324576306266108,10031649697409984521,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1508,14723324576306266108,10031649697409984521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1508,14723324576306266108,10031649697409984521,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,14723324576306266108,10031649697409984521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,14723324576306266108,10031649697409984521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1508,14723324576306266108,10031649697409984521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1508,14723324576306266108,10031649697409984521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,14723324576306266108,10031649697409984521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,14723324576306266108,10031649697409984521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,14723324576306266108,10031649697409984521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,14723324576306266108,10031649697409984521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1508,14723324576306266108,10031649697409984521,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 85ba778daa386bdf929a35a49d50ce92927a78d281d6350ab5201a5d83d5f05a
MD5 85f5e08caaebdb17e7af1b46fc542d52
SHA1 ba6a8cbc8db9b4151669f38fd6c2abf51ffbd318
SHA512 e0eebb0cd4a4f09c5f75724035fbd467b1b33d695c017500d7fceb05223e14c989c87a56fbe7bf36130f8be8518368ccc7fbea73abf3e52dc9f0e2cd62b99310
SSDEEP 96:nykRKL12xdBwpvWMoiVmdeHBrz0bUWQyV+VDCziEwb:nyk64PBGWMX+bro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ddaba11c5b395d1d2b6ba00fff9896475dda0b63ec34a8fb30b3a76a0d4c3424
MD5 57138980fe3d6c801b7146d30bcea43a
SHA1 dda75ecf57cc0b442b52bbb95182996eeddf6c0c
SHA512 0b38433c954c8f69dce5816261df670e9e282a4c43358155637c7fa32ffbc1af21fbcd642e2c86d292328b2b8bc4a94014ce0e162fa28bdd8b4b96bed784637b
SSDEEP 96:nyk8KL12xdZwpvWMoiVmdeHBrz0bUWQyV+VD7AiEwb:nyk94PZGWMX+brg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7b2ac20cd9bbca6d8b903b45208f8788c97f0ba48efa9ce9bbafdfe31273ce98
MD5 7ed376fef752b8bd852803ad7e43bcbc
SHA1 823ed5afd074ca8b263f06cafbf3a6e4be743ca6
SHA512 05844fe3d90faad16928750bfb50da25e20965433c40c203e3acb538bd608723e328bcde1ab0c4b2f9b2cdd6e2b6e4785078c6395b508267b7a8e1728de76685
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup8HHe2RUa/Mj2r3z2OMDCRR:A9iIxuERzA83h09RZxY8HvJEyraOMWRR
MD5 SHA1 SHA512 SSDEEP

Submit Download