eb9e91eec64e3ee487c0d792d873176c25e4fed4bf9ee6c30e572daff208c89a

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8fa9406b05b93734966b2c807fbb9075_JaffaCakes118.html
Size 207KB
Sample240602-2fmaksae57
SHA256 eb9e91eec64e3ee487c0d792d873176c25e4fed4bf9ee6c30e572daff208c89a
MD5 8fa9406b05b93734966b2c807fbb9075
SHA1 d225ea3966b9bfc91a6428b4f4ec5a03e4e20e81
SHA512 63657cfa1884d0dc2246681078dd8390257af1e7bc830e61d60c51c2e949c75334cda27853569723dd531e286e824d0a662d41a9a013828f2d7cea3712acd1e7
SSDEEP 6144:4530DH6NEQwjcHXxQRVufJc/09d1kO65S:4uDHQmjcxQRVufJc/TS
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
4328	msedge.exe
4328	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 3700	4328	msedge.exe	82
PID 4328 wrote to memory of 3700	4328	msedge.exe	82
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 1468	4328	msedge.exe	83
PID 4328 wrote to memory of 752	4328	msedge.exe	84
PID 4328 wrote to memory of 752	4328	msedge.exe	84
PID 4328 wrote to memory of 5088	4328	msedge.exe	85
PID 4328 wrote to memory of 5088	4328	msedge.exe	85
PID 4328 wrote to memory of 5088	4328	msedge.exe	85
PID 4328 wrote to memory of 5088	4328	msedge.exe	85
PID 4328 wrote to memory of 5088	4328	msedge.exe	85
PID 4328 wrote to memory of 5088	4328	msedge.exe	85
PID 4328 wrote to memory of 5088	4328	msedge.exe	85
PID 4328 wrote to memory of 5088	4328	msedge.exe	85
PID 4328 wrote to memory of 5088	4328	msedge.exe	85
PID 4328 wrote to memory of 5088	4328	msedge.exe	85
PID 4328 wrote to memory of 5088	4328	msedge.exe	85
PID 4328 wrote to memory of 5088	4328	msedge.exe	85
PID 4328 wrote to memory of 5088	4328	msedge.exe	85
PID 4328 wrote to memory of 5088	4328	msedge.exe	85
PID 4328 wrote to memory of 5088	4328	msedge.exe	85
PID 4328 wrote to memory of 5088	4328	msedge.exe	85
PID 4328 wrote to memory of 5088	4328	msedge.exe	85
PID 4328 wrote to memory of 5088	4328	msedge.exe	85
PID 4328 wrote to memory of 5088	4328	msedge.exe	85
PID 4328 wrote to memory of 5088	4328	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8fa9406b05b93734966b2c807fbb9075_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc36f346f8,0x7ffc36f34708,0x7ffc36f34718
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,14201508080715191129,16075262391613208538,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,14201508080715191129,16075262391613208538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2628 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,14201508080715191129,16075262391613208538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,14201508080715191129,16075262391613208538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,14201508080715191129,16075262391613208538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,14201508080715191129,16075262391613208538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,14201508080715191129,16075262391613208538,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3104 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 db234a7ce4dcf553b5a54e0c1139fab9b567fd5b5e472e1068cc909ccda77fa9
MD5 0af50e794ee896f1971e1a5e2c72ef94
SHA1 c8ad98899713f33057ebe84bdbd5e04df08ab7d0
SHA512 e24885628769233e846ec73520bbb374ec02dad7d56a141c8efe98fc6d11384e715f5e312f1cae9dc54241478629e314a21108e058661f2459410cfb60677ac6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 a4ff7485beb0ceba9764163ab3cf865295961a9148d0bf86ccf895075f5f0c16
MD5 cae4089b5b05c8e2112ac42f7a939caf
SHA1 fc80d9f77e86cac15169a3ca2d84c58b946b77f7
SHA512 975398014d097c747544d2a30fcdd39073ebea0577b0d3d988f6a02c9e42f0cb13c18b0c02ee222ea29954e2091a5dbb894afa9b7b5d772c12badb48fa43ae95
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a68d2e872d2609c1000e8d605a91715c67098edeab2289566f141388c3b965d8
MD5 65df6cb95be15a53ab75a42ca52980ed
SHA1 a990c16dda7b272d503f0e3bed52578416943353
SHA512 3a909e9b6fd3e86005113d7865dbf77d9f61349b8f4d49469bfa7b80e6e62d4a4f9cd396bcbf41e38f2961bfabbca1ba8ed92d16bcdfae117311395b2de714e9
SSDEEP 96:nkkmPKL1sT3wpvWMoiVmdeHplwtdacmUWQyV+VDCziEwb:nkkOKLWrGWMXp0Xmro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f4a0ab98185ad17d6dfa889f9f46beaaebab2fd965e97513c3a80f4bbee11b78
MD5 f2d7959d889726e6c32eb8057adc364d
SHA1 f51f5365eb71cad8b54849ce0402386fa33d9dde
SHA512 cd61077ac25e5d3c591327af17d2e4f4de2f6ba9bf95a12518106005a9a7df782d2c132b93528fc6cd6916cb806515669b46806510f189f5fb98119234801819
SSDEEP 96:nkk9PKL1sD3wpvWMoiVmde+aDXzExqrOWe2plwtdacmUWQyV+VDCAiEwb:nkkRKLWbGWMuaDXYxqrOWe2p0XmrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 929fb1afb284d5fc6e599ac95051dd235b4b84ef2d88f86aaf9bc45307c5ae8e
MD5 b37e0be0f4b1ee851254c7b6c2c84525
SHA1 8b0d70cc205b0b90327026f3d4f894742b0a5006
SHA512 d7cddbe8e03057f9bcc8c1d2f6efac2f239521a28a8b92353ce65ccb4bf1dc8e28c191e628136b5cb0061008559e9b4ef126263a50903fa3450633bae1eeae61
SSDEEP 96:nkk9PKL1sT3wpvWMoiVmdeHplwtdacmUWQyV+VDCAiEwb:nkkRKLWrGWMXp0XmrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 9d57854d1eac00d276ae0b9dceea3db0fe69893dba1d8ee4bb96494ade830771
MD5 6c6b2f96d8504aff13823a2f4923e3ad
SHA1 f8b810ddc582c27c666f05cb2ef3337159c4f792
SHA512 f6e2c6f428d5d827996e6751169ae152913e78893565dcf442d84c2d358212fb50ffd14b944e63150c6dc0c39ef578666de31cef113f4cc19fa85ab4b6c93aeb
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5841b7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5841b7.TMP
Size 1KB
SHA256 0b6084d21f1ee04cbe3aa3646d0acb1aabb9907ee0cdd4f10f1c40efaa670c4c
MD5 7a13c3994297b25870d6c88ada6c895d
SHA1 c014815b1b9f0c43e36fd76bb1a57bb319e70482
SHA512 c95515b1618df1a8a19017eeb04d3557acc20973b84fb1c1148b3c2e55210782ee20aca19a579f599dd2ee6008528d86405fa2981a2e700a7482dd8c28e47980
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 fc335885d1898a0b6a7752bf9802f4d3158f0975bb7f061db69f32fd47e58f88
MD5 efb2a6c7f590ef683539388b1a874624
SHA1 310a6024dabcc1fb8b18ef9601cfee2fc0ff8b95
SHA512 d8b61b9c19cf281caf16c4701cdfa262012a0a69b46a574ea77c9a7820961f28fc18fb742844b6d9800cfc792f524b4268862f55d77595a17a2f31f2a3cd0788
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup0Qhe2RUl2ZB3z2OMDCRHq0:A9iIxuERzA83h09RZxY0k1BaOMWRHqlW
MD5 SHA1 SHA512 SSDEEP

Submit Download