b1aca49f74786a36a67a6b5f377e90874f8c7e546f46bcd81f5d42631111b3d6

Analysis

max time kernel
148s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
905d6f449ff9271387834efb1002beb0_JaffaCakes118.html
Size 46KB
Sample240603-dr3vpsaf59
SHA256 b1aca49f74786a36a67a6b5f377e90874f8c7e546f46bcd81f5d42631111b3d6
MD5 905d6f449ff9271387834efb1002beb0
SHA1 7bfce427d6aaa1fdab1aefaf8db037a564267cf9
SHA512 42fdf5a05ae91290ca136d53ac380664454cf1543476530ec0d62d5779e3ecda2f65149256cea05751805321a833ba696da2fe9d646752be8368c7e055966c8a
SSDEEP 768:97qL5qC9EHTf4MFf02cHUujawqLzHOrRi3p4XL+OhvSJmxUxEqLPIJA5D4h7bj39:97qcC9sTf4MFf0NHUQxUxE+IHh7bj3GQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4600	msedge.exe
4600	msedge.exe
4720	identity_helper.exe
4720	identity_helper.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 3860	4600	msedge.exe	81
PID 4600 wrote to memory of 3860	4600	msedge.exe	81
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 2328	4600	msedge.exe	82
PID 4600 wrote to memory of 4036	4600	msedge.exe	83
PID 4600 wrote to memory of 4036	4600	msedge.exe	83
PID 4600 wrote to memory of 3600	4600	msedge.exe	84
PID 4600 wrote to memory of 3600	4600	msedge.exe	84
PID 4600 wrote to memory of 3600	4600	msedge.exe	84
PID 4600 wrote to memory of 3600	4600	msedge.exe	84
PID 4600 wrote to memory of 3600	4600	msedge.exe	84
PID 4600 wrote to memory of 3600	4600	msedge.exe	84
PID 4600 wrote to memory of 3600	4600	msedge.exe	84
PID 4600 wrote to memory of 3600	4600	msedge.exe	84
PID 4600 wrote to memory of 3600	4600	msedge.exe	84
PID 4600 wrote to memory of 3600	4600	msedge.exe	84
PID 4600 wrote to memory of 3600	4600	msedge.exe	84
PID 4600 wrote to memory of 3600	4600	msedge.exe	84
PID 4600 wrote to memory of 3600	4600	msedge.exe	84
PID 4600 wrote to memory of 3600	4600	msedge.exe	84
PID 4600 wrote to memory of 3600	4600	msedge.exe	84
PID 4600 wrote to memory of 3600	4600	msedge.exe	84
PID 4600 wrote to memory of 3600	4600	msedge.exe	84
PID 4600 wrote to memory of 3600	4600	msedge.exe	84
PID 4600 wrote to memory of 3600	4600	msedge.exe	84
PID 4600 wrote to memory of 3600	4600	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\905d6f449ff9271387834efb1002beb0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9d0c46f8,0x7ffd9d0c4708,0x7ffd9d0c4718
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,5323266276061295734,7550622460953381101,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,5323266276061295734,7550622460953381101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,5323266276061295734,7550622460953381101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5323266276061295734,7550622460953381101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1404 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5323266276061295734,7550622460953381101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,5323266276061295734,7550622460953381101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,5323266276061295734,7550622460953381101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5323266276061295734,7550622460953381101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5323266276061295734,7550622460953381101,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5323266276061295734,7550622460953381101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5323266276061295734,7550622460953381101,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,5323266276061295734,7550622460953381101,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 309B
SHA256 d39a78605bae1d0e106f9b158754ccc3b743c6392e79dabd28c16e6985c82089
MD5 54b5b80436f8fd47e7ff00ae815e0e9f
SHA1 ddb83ee173c9e2f4f0e7bcffab7edd3b6a3cec96
SHA512 869ce5902c30c839eddeed26d271512ecdf6a3d5ad1ce5e79806db43633fe1dddd4e169f555fb7d1ed47ae282b9ce99714ff30ff752fd97260d17024a1d2565f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 0a751f88683f5f9c4136fa91cf594eeae4e0472345dd95130cf8c399f1dd4dd3
MD5 13a56328a3ea73ac015ecc777c476daf
SHA1 12ddc4e84f0ede2c2078904a50b600ef82cda4a1
SHA512 fb4ba4da79672915e2d6c1a725e7156cb2be912efa0b90f7d4e014e3364c214ce2b9826f0de43aaea968fbee835eb44438f45cdbc71eb8d750c701d16fce9e1c
SSDEEP 96:nfkOYNB1jCga9IQwpvWMoiVmdeHpCrxbpUWQyV+VDCziEwb:nfkh1RaCQGWMXp6bpro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d9f319195ac63f49698b8bb522ecc6a9388a4f29a634b0b9dd9d0d7d2b3a97d6
MD5 0d396fc1daf577f20e0f490fadc87842
SHA1 fce8805b0dffa560cb5c83e7315274fdb6cfff65
SHA512 cccf9551fa621157b797bfc4c668a854b39a9ddfc42fdb47a3fbc695f0656f206e0233ce7cba805f83d11a120d56b1385ad09c6883ccdf7dd0e5f6b6e5e75b50
SSDEEP 96:nfkFYNB1jLga9IQwpvWMoiVmdeHpCrxbpUWQyV+VD7AiEwb:nfkw1EaCQGWMXp6bprg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 627ee9d8f608aa3d59d49900ed90c694b01f817fccb25eef976045f0b47d6dc4
MD5 f619d5500c1a20583febb42c0bd1d7ac
SHA1 a53b6472f31f9aa0cf0719d8bebc4f577bfda151
SHA512 e470fe195107c0c390fdce08743ae7ac77d7964c07baec7f439b89cfc87a80ff8d131cef8c65ba8dcff827ec81714024c33a2608afe2e9376f5215b592955a6e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupkkuSe2RUXjf7ZoK3z2OMD8:A9iIxuERzA83h09RZxYkkusSzZoKaOMQ
MD5 SHA1 SHA512 SSDEEP

Submit Download