2deeeb5f0c83ae7df82d6ebd570a93a0d598c389e147f7118d1910f5729b15b7

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8d31dbc7188ea4807ef535a7fae75e77_JaffaCakes118.html
Size 3KB
Sample240602-hf7fzaee69
SHA256 2deeeb5f0c83ae7df82d6ebd570a93a0d598c389e147f7118d1910f5729b15b7
MD5 8d31dbc7188ea4807ef535a7fae75e77
SHA1 0219a357309d01f1d56080090e965030b35c3395
SHA512 505798a93c8231d01c4a5d8e543ddc12976a3966073968b65147e92a1b2d85cb682eb1ba5d8fa4324ecbc03a0a4dccd441a4345a72d3f701851421bb1b2c393c
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
1228	msedge.exe
1228	msedge.exe
4780	identity_helper.exe
4780	identity_helper.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1564	1228	msedge.exe	83
PID 1228 wrote to memory of 1564	1228	msedge.exe	83
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4388	1228	msedge.exe	84
PID 1228 wrote to memory of 4444	1228	msedge.exe	85
PID 1228 wrote to memory of 4444	1228	msedge.exe	85
PID 1228 wrote to memory of 4572	1228	msedge.exe	86
PID 1228 wrote to memory of 4572	1228	msedge.exe	86
PID 1228 wrote to memory of 4572	1228	msedge.exe	86
PID 1228 wrote to memory of 4572	1228	msedge.exe	86
PID 1228 wrote to memory of 4572	1228	msedge.exe	86
PID 1228 wrote to memory of 4572	1228	msedge.exe	86
PID 1228 wrote to memory of 4572	1228	msedge.exe	86
PID 1228 wrote to memory of 4572	1228	msedge.exe	86
PID 1228 wrote to memory of 4572	1228	msedge.exe	86
PID 1228 wrote to memory of 4572	1228	msedge.exe	86
PID 1228 wrote to memory of 4572	1228	msedge.exe	86
PID 1228 wrote to memory of 4572	1228	msedge.exe	86
PID 1228 wrote to memory of 4572	1228	msedge.exe	86
PID 1228 wrote to memory of 4572	1228	msedge.exe	86
PID 1228 wrote to memory of 4572	1228	msedge.exe	86
PID 1228 wrote to memory of 4572	1228	msedge.exe	86
PID 1228 wrote to memory of 4572	1228	msedge.exe	86
PID 1228 wrote to memory of 4572	1228	msedge.exe	86
PID 1228 wrote to memory of 4572	1228	msedge.exe	86
PID 1228 wrote to memory of 4572	1228	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8d31dbc7188ea4807ef535a7fae75e77_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb7ba46f8,0x7ffcb7ba4708,0x7ffcb7ba4718
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,10182539234873892642,6581144579635882866,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,10182539234873892642,6581144579635882866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,10182539234873892642,6581144579635882866,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10182539234873892642,6581144579635882866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10182539234873892642,6581144579635882866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10182539234873892642,6581144579635882866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10182539234873892642,6581144579635882866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10182539234873892642,6581144579635882866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10182539234873892642,6581144579635882866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10182539234873892642,6581144579635882866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10182539234873892642,6581144579635882866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,10182539234873892642,6581144579635882866,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 276B
SHA256 02bd271fbf1d8f8cfeb229ec24d7bfb1c261116853c2e66a3f5d0b3536f59a25
MD5 63e94862b42530f86676ad4d8dad984d
SHA1 3fd2230f79711e641c7d8bc1fc8f6d671319aec8
SHA512 8f57ba1d96f3a97a7867f7eb43efd22baea3a78766fd88e87affcbc1e2e1699de833cbe9d78d22fa784ebf9602bd2006ee315ea13aebbcb79b56ec137c7a5aff
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 475cb00b5713710d3b7cd4419ae4b2fd93d745b1cc286e4297d463b4c4ea03b1
MD5 5488419496b21d12504c208f7f77be6a
SHA1 7bd0ec74811c391191c5ede4f64953c72e51259c
SHA512 9366f4a5f67ddf95fbb04fd3826e0afe15c55381ca95c7771ae1657eaf4460c78c5890e98b4035dd64c2cc889d2248642f3522cd08a782fd9a8499f6eb4f1e74
SSDEEP 96:nZk8c61/Ej0wpvWMoiVmdeEHqmQIDxUWQyV+VD7AiEwb:nZkr6FEj0GWMgqOxrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 9a4d8181384cfc4ca477d8a0701e6aa23573f3bce815eea0bf56c63e0133dac3
MD5 4bae13ce8f87fdd30e60bd8cdae82095
SHA1 f7e8824c8b5e9dce41833c3f07d9d48e34b29e7f
SHA512 bf285fed850914ce72966a2d3b01aa817fa0ef8e1dab7ea6059e3cf47b0bd882d82b8090bc44ecb0fc6330f6cc67e518da8ba982c6fff20016d7ff6802c73808
SSDEEP 96:nZkRc61/Ej0wpvWMoiVmdeHmQIDxUWQyV+VDCziEwb:nZkO6FEj0GWMXOxro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e8aa1571a778a757fed62d1a83f4178a180d26e1c013bd029466abbf291230ec
MD5 5d4d741037bd361f477897fc2a464e43
SHA1 1a6449b7ba9f6e91985edd85350b7dd7358fda45
SHA512 3f57ad30c31639ecd07c7ff4060ec0050a582b5dac7dc92f640eae094ef431fef2be566fe47bca85469661c538a594a13b613e55ca1b1a89b53188dae7ac950d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupXue2RU+d/IKbNfYOxhZHn0:A9iIxuERzA83h09RZxYXwvddxxTHqTME
MD5 SHA1 SHA512 SSDEEP

Submit Download