3c592984e5252f054f739a09363411745e08b2b7710cf003b63adcb4e402bc19

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91112f5fbbf8dfd50344164f1c40c989_JaffaCakes118.html
Size 26KB
Sample240603-j2rhbagg6v
SHA256 3c592984e5252f054f739a09363411745e08b2b7710cf003b63adcb4e402bc19
MD5 91112f5fbbf8dfd50344164f1c40c989
SHA1 248a4bc1b07853768684332828baf6d25b9ca37a
SHA512 8b8f277eefdb5311d76bf4b463ed68093a023d3038184acacea60bf78ecc5a08b56b805118e9799d315a1003690d180b468f3921ceb1cb97c8a365c62447dd5f
SSDEEP 384:CyihE2CpfZ39oRW03HfWgDsB9QHIypd1w:CyihE9fZN7mpd1w
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
4820	msedge.exe
4820	msedge.exe
2044	identity_helper.exe
2044	identity_helper.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 448	4820	msedge.exe	83
PID 4820 wrote to memory of 448	4820	msedge.exe	83
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 2684	4820	msedge.exe	84
PID 4820 wrote to memory of 3880	4820	msedge.exe	85
PID 4820 wrote to memory of 3880	4820	msedge.exe	85
PID 4820 wrote to memory of 3640	4820	msedge.exe	86
PID 4820 wrote to memory of 3640	4820	msedge.exe	86
PID 4820 wrote to memory of 3640	4820	msedge.exe	86
PID 4820 wrote to memory of 3640	4820	msedge.exe	86
PID 4820 wrote to memory of 3640	4820	msedge.exe	86
PID 4820 wrote to memory of 3640	4820	msedge.exe	86
PID 4820 wrote to memory of 3640	4820	msedge.exe	86
PID 4820 wrote to memory of 3640	4820	msedge.exe	86
PID 4820 wrote to memory of 3640	4820	msedge.exe	86
PID 4820 wrote to memory of 3640	4820	msedge.exe	86
PID 4820 wrote to memory of 3640	4820	msedge.exe	86
PID 4820 wrote to memory of 3640	4820	msedge.exe	86
PID 4820 wrote to memory of 3640	4820	msedge.exe	86
PID 4820 wrote to memory of 3640	4820	msedge.exe	86
PID 4820 wrote to memory of 3640	4820	msedge.exe	86
PID 4820 wrote to memory of 3640	4820	msedge.exe	86
PID 4820 wrote to memory of 3640	4820	msedge.exe	86
PID 4820 wrote to memory of 3640	4820	msedge.exe	86
PID 4820 wrote to memory of 3640	4820	msedge.exe	86
PID 4820 wrote to memory of 3640	4820	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91112f5fbbf8dfd50344164f1c40c989_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3a6d46f8,0x7ffe3a6d4708,0x7ffe3a6d4718
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,16954798207121589534,8557882640841155828,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,16954798207121589534,8557882640841155828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,16954798207121589534,8557882640841155828,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,16954798207121589534,8557882640841155828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2864 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,16954798207121589534,8557882640841155828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,16954798207121589534,8557882640841155828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,16954798207121589534,8557882640841155828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,16954798207121589534,8557882640841155828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,16954798207121589534,8557882640841155828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,16954798207121589534,8557882640841155828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,16954798207121589534,8557882640841155828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,16954798207121589534,8557882640841155828,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 911d0059587d288484b9d89caa20e4d31963f4168f7f869a5bfb1b1b3ebe18f4
MD5 0c39fda5ae213d4121c9d65b17f8c1af
SHA1 c83472e587868b4b2d75cd3cb6378678c1601917
SHA512 3fe3688e97c3a69395fdf009272b5fa3d2ffaf1916a54f0c025aa824c997d045b2b364145470771c97a53dc6704bcef41cca03f64b7a4a8464bf98e72aa4940b
SSDEEP 96:n6kMy1mega9IQwpvWMoiVmdeHpCrVbLUWQyV+VDCziEwb:n6kLoNaCQGWMXpKbLro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5365e1bdc275e099b004ae6ee2d1c73c4007a2b44ef4a653d135afe9003f3721
MD5 c51bcdb335751fd087fd2265638d91eb
SHA1 2824bed8b940a594c16c5c0858525d87e6121b4f
SHA512 245c61e495a816fc8743de383d2716f03d0ecc46991b33f46ab2cdf2af844eb97ce36ccf5f9c144f0500a39f1c84e69be7d013e2d44f20801850963544deff6f
SSDEEP 96:n6k3y1muga9IQwpvWMoiVmdeHpCrVbLUWQyV+VDCAiEwb:n6kio9aCQGWMXpKbLrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 b5b5255b9e5f39fd42f3438321d15dc26ae9d074410a4e78d12acf391984ffec
MD5 c442775460ab50d4f68f652d980e49a5
SHA1 f29a31925c1a0618b89190556134f73fefeb6b57
SHA512 23fc4c1b493063e9fa3d9ea4f6b83dc54b7c2efd4143a5310d478d775e9a4807d24e79d0af83f1142868b3e85fec6859bc9bcbb1261ee94bed3a71f3aceac3b7
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupxkfe2RUykjf7ZB3z2OMDCY:A9iIxuERzA83h09RZxYxkntgzZBaOMWY
MD5 SHA1 SHA512 SSDEEP

Submit Download