f92ddd96b73ad1ed0318d8d1a58befc4fccac5ac7ec933fa2a242308df14a3a8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8ffe57f806a51c498e6ba7ca32cefa79_JaffaCakes118.html
Size 144KB
Sample240603-a2zz1sec63
SHA256 f92ddd96b73ad1ed0318d8d1a58befc4fccac5ac7ec933fa2a242308df14a3a8
MD5 8ffe57f806a51c498e6ba7ca32cefa79
SHA1 5584d732bf71e1a56f7222500b493d08da90ec09
SHA512 7b81c129ea9ac28512f430e906af839bc7ad8d6b454cc23f3695850fbdae826dffc856e482c1e0dde93f8ef688e3d403bc99e3902a66b8df6c5385890affa6fc
SSDEEP 1536:DHNFGaVF2tqVPyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:uYXByfkMY+BES09JXAnyrZalI+YQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
848	msedge.exe
848	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 3500	848	msedge.exe	83
PID 848 wrote to memory of 3500	848	msedge.exe	83
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 2084	848	msedge.exe	84
PID 848 wrote to memory of 4416	848	msedge.exe	85
PID 848 wrote to memory of 4416	848	msedge.exe	85
PID 848 wrote to memory of 3852	848	msedge.exe	86
PID 848 wrote to memory of 3852	848	msedge.exe	86
PID 848 wrote to memory of 3852	848	msedge.exe	86
PID 848 wrote to memory of 3852	848	msedge.exe	86
PID 848 wrote to memory of 3852	848	msedge.exe	86
PID 848 wrote to memory of 3852	848	msedge.exe	86
PID 848 wrote to memory of 3852	848	msedge.exe	86
PID 848 wrote to memory of 3852	848	msedge.exe	86
PID 848 wrote to memory of 3852	848	msedge.exe	86
PID 848 wrote to memory of 3852	848	msedge.exe	86
PID 848 wrote to memory of 3852	848	msedge.exe	86
PID 848 wrote to memory of 3852	848	msedge.exe	86
PID 848 wrote to memory of 3852	848	msedge.exe	86
PID 848 wrote to memory of 3852	848	msedge.exe	86
PID 848 wrote to memory of 3852	848	msedge.exe	86
PID 848 wrote to memory of 3852	848	msedge.exe	86
PID 848 wrote to memory of 3852	848	msedge.exe	86
PID 848 wrote to memory of 3852	848	msedge.exe	86
PID 848 wrote to memory of 3852	848	msedge.exe	86
PID 848 wrote to memory of 3852	848	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8ffe57f806a51c498e6ba7ca32cefa79_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e77046f8,0x7ff8e7704708,0x7ff8e7704718
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7359190208516146288,10603836244752649101,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,7359190208516146288,10603836244752649101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,7359190208516146288,10603836244752649101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7359190208516146288,10603836244752649101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7359190208516146288,10603836244752649101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7359190208516146288,10603836244752649101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7359190208516146288,10603836244752649101,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3636 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
MD5 87f7abeb82600e1e640b843ad50fe0a1
SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 836b7b65e4299c1a7b0a0af54155b45e5a350d3725d1fcee7329bdbc0b815607
MD5 8fcd91ff358cf1a54ec6ab0d2b8dd266
SHA1 77fa4045868ba0fede5843576c2342021eed83f7
SHA512 a5b296034c5ec711998416beec3597907f9b365084615a14ffadb6d49fa40f96deb0514ec8c88695d2aeacdc255188f1cb9c5c24c627c8064c675e8fcfa3aa82
SSDEEP 96:nZkxn1CJak0wpvWMoiVmdeH/z5lzUWQyV+VDCziEwb:nZk5YJabGWMXfzro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 35eb070b35084e5070563a19d74eae76f2cc93f57f75c4a30a7bc174fc767470
MD5 0aa37df84d7d58df66d8521f26644689
SHA1 9adce084ce9b13fd93e9951b46d5bf1726d5b684
SHA512 ec36f3f48125492161451fa778d235d2f38a6c8717b091ba98c13666b655502556841cb7d1ba1b05f5693cf40b4461d21e199bdd6c56884961624b1ec6a7ed5a
SSDEEP 96:nZkcn1CJal0wpvWMoiVmdeH/z5lzUWQyV+VDCAiEwb:nZk2YJaiGWMXfzrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 53520c85571e3b8a8e6aca771d4d49975e8d913e6fc7668d20cc0b743b5100b0
MD5 0629b6410a8490d873856538ab88b6cd
SHA1 2bf8e3e829e832cb37a29426a6e5f632bbebe61d
SHA512 cb774a1f03883d7d64ff960a856e0f101c44fa6759cfb2ef3ccffca11db3405f982c09e932504df34b1803f5a1f7e59c5265c6a13d13661908c437cfc2d87bb1
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupYv9e2RUsCPyf3z2OMDCRHT:A9iIxuERzA83h09RZxY2ZBrfaOMWRHqU
MD5 SHA1 SHA512 SSDEEP

Submit Download