64a163373454cb210173b3ffb5198e4bd6e56ab8ef9dd8b4b2c9965d8be8b75a

Analysis

max time kernel
141s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 07:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8d4c6d884302f5eb21447c2dd4d07809_JaffaCakes118.html
Size 346KB
Sample240602-h7hxpafd67
SHA256 64a163373454cb210173b3ffb5198e4bd6e56ab8ef9dd8b4b2c9965d8be8b75a
MD5 8d4c6d884302f5eb21447c2dd4d07809
SHA1 1677ae54d7cf52bf75e2a9cecf306c16e234a4c8
SHA512 105f030b15c0eff64806d4ebc06d143729f6b1c1b7e3092a768fa3c244f3eff6b512d3b188f574c72ec529f3b63eea29f3e6b3a06023e280ad881247b39512b4
SSDEEP 6144:SssMYod+X3oI+YNsMYod+X3oI+YFsMYod+X3oI+YP:D5d+X3X5d+X3r5d+X3J
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
764	msedge.exe
764	msedge.exe
4228	identity_helper.exe
4228	identity_helper.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 4828	764	msedge.exe	82
PID 764 wrote to memory of 4828	764	msedge.exe	82
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 4656	764	msedge.exe	83
PID 764 wrote to memory of 3088	764	msedge.exe	84
PID 764 wrote to memory of 3088	764	msedge.exe	84
PID 764 wrote to memory of 3520	764	msedge.exe	85
PID 764 wrote to memory of 3520	764	msedge.exe	85
PID 764 wrote to memory of 3520	764	msedge.exe	85
PID 764 wrote to memory of 3520	764	msedge.exe	85
PID 764 wrote to memory of 3520	764	msedge.exe	85
PID 764 wrote to memory of 3520	764	msedge.exe	85
PID 764 wrote to memory of 3520	764	msedge.exe	85
PID 764 wrote to memory of 3520	764	msedge.exe	85
PID 764 wrote to memory of 3520	764	msedge.exe	85
PID 764 wrote to memory of 3520	764	msedge.exe	85
PID 764 wrote to memory of 3520	764	msedge.exe	85
PID 764 wrote to memory of 3520	764	msedge.exe	85
PID 764 wrote to memory of 3520	764	msedge.exe	85
PID 764 wrote to memory of 3520	764	msedge.exe	85
PID 764 wrote to memory of 3520	764	msedge.exe	85
PID 764 wrote to memory of 3520	764	msedge.exe	85
PID 764 wrote to memory of 3520	764	msedge.exe	85
PID 764 wrote to memory of 3520	764	msedge.exe	85
PID 764 wrote to memory of 3520	764	msedge.exe	85
PID 764 wrote to memory of 3520	764	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8d4c6d884302f5eb21447c2dd4d07809_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd711f46f8,0x7ffd711f4708,0x7ffd711f4718
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,5007515128093180425,7156607454724583565,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,5007515128093180425,7156607454724583565,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,5007515128093180425,7156607454724583565,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5007515128093180425,7156607454724583565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5007515128093180425,7156607454724583565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,5007515128093180425,7156607454724583565,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3236 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,5007515128093180425,7156607454724583565,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5007515128093180425,7156607454724583565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5007515128093180425,7156607454724583565,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5007515128093180425,7156607454724583565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5007515128093180425,7156607454724583565,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,5007515128093180425,7156607454724583565,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 64a5e71b9cd1b6bd6adb3e070b606385ddda1cc3da23cf2f7053fc8480ad9e87
MD5 fbd0d5195aa0c95fa9cd8b21edb9537b
SHA1 3a8fa202077dc00e7dfa432e0010e2ec5bdb0b6f
SHA512 c32e4c1fe7e32ddea001922fd6aa83e38bf247ce9669c28aebd93d9783fd9eefbad420f8b04793867c294575982a4ebabe0f2c1f18da1c5f8ec516f02a5f8045
SSDEEP 96:nHkL2k1FT2wpvWMoiVmdeHk4/PUWQyV+VDCziEwb:nHk5bT2GWMXZPro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4cf6231318ec2b38b79d8cd5a95fe37c65bf48251cb6f89f8618dcf15ba20b35
MD5 99fd8db959ba66f4859868569e4d6d87
SHA1 d589d5448f5b0b1c6c0cbdc12a9e6951554dff27
SHA512 65a4cd5bc53b7983d96b936f18a9a272613d33ba972be2d2552098782fd61e2dfe07ab60ecb0544e68e50e518db29e7a331353aef067b4d1e373a8046318c918
SSDEEP 96:nHki2k1FC2wpvWMoiVmdeHkh/PUWQyV+VD7AiEwb:nHkObC2GWMX4Prg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 21e73faddef81202347e70d3e1a91fd4580aeff33a8b9063ddd054705dd2bb78
MD5 53ee785fa47bce29fc18dedf3adbf01e
SHA1 caf62172bf0100f08370f235a0489189a6b54c82
SHA512 8db30423955b23eb9260d7d26dc5c970c04b50217662e1d86960da8d1f122cd8b8763fdeaaa6a44b804f5da7ebb4f4c4b9e8aa6f66580ed1a911ce22833b140c
SSDEEP 96:nHki2k1FT2wpvWMoiVmdeHk4/PUWQyV+VDCAiEwb:nHkObT2GWMXZPrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 df4acdca9dff7d6bcb4990e527914edad774b3f56c480e904e5d558392cdd49d
MD5 13cf0ab08708a11aefc3b5fff76d11c9
SHA1 3b381720e3345416904336174dfb378ebe71d1fe
SHA512 e05e9ae3af57749f7d023ff3ae8bd74a639ab2521ff7974ae65e4898d1f335670ef359ff3a734ade3567ef4d778e5097e64cd2bc3974274b76b44dd24f08dcd5
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupIvGe2RUhy4VP3z2OMDCRH+:A9iIxuERzA83h09RZxYsI2PaOMWRHql7
MD5 SHA1 SHA512 SSDEEP

Submit Download