a2711e8a6d4cdfb3b0355320d36678db010c157c576039cc48ff2fe89b18fb48

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8fd2a9f1245eb43bfca4a9b430124823_JaffaCakes118.html
Size 36KB
Sample240602-3kwv9acd44
SHA256 a2711e8a6d4cdfb3b0355320d36678db010c157c576039cc48ff2fe89b18fb48
MD5 8fd2a9f1245eb43bfca4a9b430124823
SHA1 7fdfd6139b82a5f7d0f5fae2aa2c476288b32324
SHA512 99d1d25001a054967ccc87e0732aa67351da3c747ac601bdca3db2e32b5e8cfadc044d33ace307a41f1f7deed963a53a591c5fb43136b72d897fe642440f4a28
SSDEEP 768:zwx/MDTHuw88hAR/ZPXmE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TkZO86DJtxo6qLg:Q/bbJxNVTuCS+/t88K
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
3956	msedge.exe
3956	msedge.exe
2336	identity_helper.exe
2336	identity_helper.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 5092	3956	msedge.exe	82
PID 3956 wrote to memory of 5092	3956	msedge.exe	82
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 896	3956	msedge.exe	83
PID 3956 wrote to memory of 4472	3956	msedge.exe	84
PID 3956 wrote to memory of 4472	3956	msedge.exe	84
PID 3956 wrote to memory of 2360	3956	msedge.exe	85
PID 3956 wrote to memory of 2360	3956	msedge.exe	85
PID 3956 wrote to memory of 2360	3956	msedge.exe	85
PID 3956 wrote to memory of 2360	3956	msedge.exe	85
PID 3956 wrote to memory of 2360	3956	msedge.exe	85
PID 3956 wrote to memory of 2360	3956	msedge.exe	85
PID 3956 wrote to memory of 2360	3956	msedge.exe	85
PID 3956 wrote to memory of 2360	3956	msedge.exe	85
PID 3956 wrote to memory of 2360	3956	msedge.exe	85
PID 3956 wrote to memory of 2360	3956	msedge.exe	85
PID 3956 wrote to memory of 2360	3956	msedge.exe	85
PID 3956 wrote to memory of 2360	3956	msedge.exe	85
PID 3956 wrote to memory of 2360	3956	msedge.exe	85
PID 3956 wrote to memory of 2360	3956	msedge.exe	85
PID 3956 wrote to memory of 2360	3956	msedge.exe	85
PID 3956 wrote to memory of 2360	3956	msedge.exe	85
PID 3956 wrote to memory of 2360	3956	msedge.exe	85
PID 3956 wrote to memory of 2360	3956	msedge.exe	85
PID 3956 wrote to memory of 2360	3956	msedge.exe	85
PID 3956 wrote to memory of 2360	3956	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8fd2a9f1245eb43bfca4a9b430124823_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7e4646f8,0x7ffe7e464708,0x7ffe7e464718
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14148133663395446764,3026251489631444244,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,14148133663395446764,3026251489631444244,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,14148133663395446764,3026251489631444244,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14148133663395446764,3026251489631444244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14148133663395446764,3026251489631444244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14148133663395446764,3026251489631444244,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14148133663395446764,3026251489631444244,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14148133663395446764,3026251489631444244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14148133663395446764,3026251489631444244,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14148133663395446764,3026251489631444244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14148133663395446764,3026251489631444244,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14148133663395446764,3026251489631444244,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
MD5 537815e7cc5c694912ac0308147852e4
SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
MD5 8b167567021ccb1a9fdf073fa9112ef0
SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 614B
SHA256 c24244ab9d2465ee7130c586088a751a375296bff9c07894ed0e63c235357a30
MD5 31ca2814dc8cf340f5281ca4bfa604dc
SHA1 be0b5dab00684bc2d5734355db5fa9b1d15dd6de
SHA512 bab857bc3aaf8b356ce0d0036ea343bd39343f9d88e19606d6a546fb6ec913416b9a4489a7ad9f8d5c68501e21aca09cff37ebe25ff80c3d274c72c1818813df
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ac06e46ce4a64b3fd56271e6879624812fcc716b9bbb07fa19d8770c1933173c
MD5 de0fdcfdf01e8107006f0a72b1a0de86
SHA1 ab5a95db8053d00ad4c7977d852e462e7cab5908
SHA512 0afd6899acc1a3ee1bf00ed4e6c87d21694dde006d3054d4cedb466caf8bcb8ec103b17aadb5d0152e6b99ba2ffdb8b5a6538631357ea98fc37243394f482b36
SSDEEP 96:nOkmE12r9wpvWMoiVmdeHpRQ82UWQyV+VDCziEwb:nOkbcr9GWMXpp2ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1ec3308d5f3cb87f2b20f4600d2f5544c06846838d5bb52628e0fa61e1375f4b
MD5 6ceb58ed322a60870600804f282d0aee
SHA1 43115617df906e84d4173eff499e2b198dcd0365
SHA512 eab4792920a52e66723b5e92fef2109b1ae46265c0a39b3c524c32b5c298a9e8d71f9fea50f70d8f05991e78c98f6cdfd04a0d39956af8d47816bb99c02f82ae
SSDEEP 96:nOk9E12b9wpvWMoiVmdeEfit2pRQ82UWQyV+VD7AiEwb:nOkKcb9GWMgit2pp2rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 8837f107f68028fdd447ea89a387f27eddd67d1264bb0010bc7df89102743f07
MD5 a6423a8e94223da51a996e52a4715ccc
SHA1 72c3b8366c54a22037f04beaf5a21539d1cddcb7
SHA512 e3d195f86d8e8a91a42cab0bdbdd71dbaca4296e6e04d77723f3314ef59c0dfbad3cad51b5220ea0638a25f449826d67cdab49bec1e0296419846467efd6c227
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupaNcde2RUvqTOK3z2OMDCRi:A9iIxuERzA83h09RZxYaNc57OKaOMWRi
MD5 SHA1 SHA512 SSDEEP

Submit Download