0e082897337edc8b0fda4a6fb1846685d0ca0836c56dc38498fe0679905486c2

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 23:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8fd3695c0ed368c94b01f49cf97c24c0_JaffaCakes118.html
Size 85KB
Sample240602-3ldfascd59
SHA256 0e082897337edc8b0fda4a6fb1846685d0ca0836c56dc38498fe0679905486c2
MD5 8fd3695c0ed368c94b01f49cf97c24c0
SHA1 1bbce9f2dae4c386f9c80c35e2c159039c74afd8
SHA512 99b163f58ca1b75b7faa98cf3627d47486bdb2d2345650800c328507c0e39949c924c3a8213591a9ad23bafa92a23962e23029ef2f17814cd7ce8b5c5f85314e
SSDEEP 1536:aR17AcZ7G4x9TRV+Q92R+SZu9or+puCP3fYP4bHd7wajtt+RfwShW0efhuu5vcbs:+AcZ7N9TRV+Q92R+SZu9or+HXYP4bHdb
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1336	msedge.exe
1336	msedge.exe
2784	msedge.exe
2784	msedge.exe
2712	identity_helper.exe
2712	identity_helper.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 4576	2784	msedge.exe	81
PID 2784 wrote to memory of 4576	2784	msedge.exe	81
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 4992	2784	msedge.exe	82
PID 2784 wrote to memory of 1336	2784	msedge.exe	83
PID 2784 wrote to memory of 1336	2784	msedge.exe	83
PID 2784 wrote to memory of 3644	2784	msedge.exe	84
PID 2784 wrote to memory of 3644	2784	msedge.exe	84
PID 2784 wrote to memory of 3644	2784	msedge.exe	84
PID 2784 wrote to memory of 3644	2784	msedge.exe	84
PID 2784 wrote to memory of 3644	2784	msedge.exe	84
PID 2784 wrote to memory of 3644	2784	msedge.exe	84
PID 2784 wrote to memory of 3644	2784	msedge.exe	84
PID 2784 wrote to memory of 3644	2784	msedge.exe	84
PID 2784 wrote to memory of 3644	2784	msedge.exe	84
PID 2784 wrote to memory of 3644	2784	msedge.exe	84
PID 2784 wrote to memory of 3644	2784	msedge.exe	84
PID 2784 wrote to memory of 3644	2784	msedge.exe	84
PID 2784 wrote to memory of 3644	2784	msedge.exe	84
PID 2784 wrote to memory of 3644	2784	msedge.exe	84
PID 2784 wrote to memory of 3644	2784	msedge.exe	84
PID 2784 wrote to memory of 3644	2784	msedge.exe	84
PID 2784 wrote to memory of 3644	2784	msedge.exe	84
PID 2784 wrote to memory of 3644	2784	msedge.exe	84
PID 2784 wrote to memory of 3644	2784	msedge.exe	84
PID 2784 wrote to memory of 3644	2784	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8fd3695c0ed368c94b01f49cf97c24c0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc53246f8,0x7ffcc5324708,0x7ffcc5324718
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,16638006337204580225,13631328527974961864,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,16638006337204580225,13631328527974961864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,16638006337204580225,13631328527974961864,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,16638006337204580225,13631328527974961864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,16638006337204580225,13631328527974961864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,16638006337204580225,13631328527974961864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1832 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,16638006337204580225,13631328527974961864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,16638006337204580225,13631328527974961864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,16638006337204580225,13631328527974961864,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,16638006337204580225,13631328527974961864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,16638006337204580225,13631328527974961864,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,16638006337204580225,13631328527974961864,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
MD5 ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1 a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA512 e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
MD5 f53207a5ca2ef5c7e976cbb3cb26d870
SHA1 49a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA512 be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 987B
SHA256 02cb5ab768bfba119e85eac47db2edc1e0a079c12dc86e3ad6deefaaa16c430f
MD5 15cc0a2b2d6e0bc3c8cc66c8a01a9630
SHA1 d03d1ebffdc8a5dca44215aa098f92ccadeed6c1
SHA512 c47d0976dab84bcc2d779274c8643fd198608a33ad6422325cafb541495acb7b8b01b8e84b889fd10d2fe8f744eda76f19d9c56cdf7fe206e36e1f4798575d27
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 4bd6dcb2efe3df24889e845e3928fc2ded6960abb1f4449563fdd83141878758
MD5 950cf8d9e8f6ba052152cf12977f28b9
SHA1 e3293c46ef502c94a00bf0033a29dcdb0f364c40
SHA512 75aeaedf6b3c804d9b6b859125cfe9ef918df670a2e0a016082d765862bc91c0c0b2b6cb547bf24b68ded20d9cb791c2b549aebd50c70607160cf2ee684d57a1
SSDEEP 96:nmkKN1XtPe8wpvWMoiVmdeHpw8EgA6uUWQyV+VDCziEwb:nmkiLPe8GWMXpwP6uro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 20520d7ab982ead77b4983653455adbbd64b4268de8632468047e4f1d79562d6
MD5 c2023b1a1cf18aa5ec71e87ef3c68e41
SHA1 1f5d9ce5fda00b9977787f286946e6acb7b3c767
SHA512 e9b09a0a91c7a1e2a33a3b0b6ff03464d0980c2543575a7f8caae09276615592e2f17ee12fe565e4e67f45f3a1f8d69d5f60873aebc1a2f1b22ae703bbc447d0
SSDEEP 96:nmk3N1Xt/e8wpvWMoiVmde3f2pw8BgA6uUWQyV+VD7AiEwb:nmk9L/e8GWM/2pw86urg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d46bb8c7c7fb1e91a067eca9226d1707fd3d49afafac093f4502eade5c4fae23
MD5 8d01dd73eaa4716db8e888787cac07a4
SHA1 402c7828d8fef99748bf6fca46deae51cc524a5f
SHA512 58f4025636523ce5d626633033b6c5c9441f94d285abe54dcb5dfbd749bd2554731e1a5c068e8fe2b9932008d5b63172109e87fbff2846523d5c128a8a6a4622
SSDEEP 96:nmk3N1XtPe8wpvWMoiVmde3f2pw8EgA6uUWQyV+VDCAiEwb:nmk9LPe8GWM/2pwP6urV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 4cda5f95d93f68bac86bd2ca8f45fa1616cd4aa71b364c87b76bd0e831adc2d0
MD5 805c354439c718fc2b486c69c7075ba8
SHA1 c263acb5fc812fb63e5c069209fed2d9aae0a20f
SHA512 f1d574de315e7306e2f004d4c2ce5627fc4a4b7cb39683daa975253d435e3a5a93d4c8d2bbf9cfea1d502532c8d92b4230b4ceb04b3383dd9d922c1b807904e4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupBMSe2RUGJ+k73z2OMDCRH9:A9iIxuERzA83h09RZxYft7aOMWRHqlWP
MD5 SHA1 SHA512 SSDEEP

Submit Download