a7d1c0b13860255f1d218eceff43b4bf2dbffaaa9b6771ce62148052d6724041

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
911657ae63d8342cbe5ac376aef4706a_JaffaCakes118.html
Size 134KB
Sample240603-j6pvaaab75
SHA256 a7d1c0b13860255f1d218eceff43b4bf2dbffaaa9b6771ce62148052d6724041
MD5 911657ae63d8342cbe5ac376aef4706a
SHA1 9a3985d2950900f5c400ee215ac4a08bc85d8ae4
SHA512 5114eb1746c031d5abda4e43354acd5025d5d48989a419c113a8edd7ee6f8dae49947e93f9f944776266c835e25e5f300436d0f4a3bd99fbba5e3de1b151c186
SSDEEP 3072:SVixjJ61ehDlc/SRmEFNu7Mo9yZ4zeuXh457+XRushEFDvVx:SVkhDlc/SRmEFNu7Mo9yZ4zeuXh457+a
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
2552	msedge.exe
2552	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 3968	2552	msedge.exe	82
PID 2552 wrote to memory of 3968	2552	msedge.exe	82
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	83
PID 2552 wrote to memory of 4588	2552	msedge.exe	84
PID 2552 wrote to memory of 4588	2552	msedge.exe	84
PID 2552 wrote to memory of 3376	2552	msedge.exe	85
PID 2552 wrote to memory of 3376	2552	msedge.exe	85
PID 2552 wrote to memory of 3376	2552	msedge.exe	85
PID 2552 wrote to memory of 3376	2552	msedge.exe	85
PID 2552 wrote to memory of 3376	2552	msedge.exe	85
PID 2552 wrote to memory of 3376	2552	msedge.exe	85
PID 2552 wrote to memory of 3376	2552	msedge.exe	85
PID 2552 wrote to memory of 3376	2552	msedge.exe	85
PID 2552 wrote to memory of 3376	2552	msedge.exe	85
PID 2552 wrote to memory of 3376	2552	msedge.exe	85
PID 2552 wrote to memory of 3376	2552	msedge.exe	85
PID 2552 wrote to memory of 3376	2552	msedge.exe	85
PID 2552 wrote to memory of 3376	2552	msedge.exe	85
PID 2552 wrote to memory of 3376	2552	msedge.exe	85
PID 2552 wrote to memory of 3376	2552	msedge.exe	85
PID 2552 wrote to memory of 3376	2552	msedge.exe	85
PID 2552 wrote to memory of 3376	2552	msedge.exe	85
PID 2552 wrote to memory of 3376	2552	msedge.exe	85
PID 2552 wrote to memory of 3376	2552	msedge.exe	85
PID 2552 wrote to memory of 3376	2552	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\911657ae63d8342cbe5ac376aef4706a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9903a46f8,0x7ff9903a4708,0x7ff9903a4718
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15026516074494520377,13998892722684570155,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,15026516074494520377,13998892722684570155,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,15026516074494520377,13998892722684570155,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15026516074494520377,13998892722684570155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15026516074494520377,13998892722684570155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15026516074494520377,13998892722684570155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15026516074494520377,13998892722684570155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15026516074494520377,13998892722684570155,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 7122f4ba0693589cdfec2fe99f066224354aea7420bb56373fd1de815eca8193
MD5 3817c5fff077d0b889f0a6369677a0e4
SHA1 fa67438dd9823042ef452c63d0cb6b2a7875dd14
SHA512 a6d6bfc807d3b80fe19d2085bad11403576a90171135b1c16996c1f0d49faf9508c416b74c4b3e483f8b9bd8ba478148d495a669cec5f2cea9eae3f650f011f7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 49e48795a6f39dc3f6c5880524a7300fc03473d10695c605cf196f05fbefa0fe
MD5 94e42e0737104a6dc858d21cb9145a70
SHA1 ffd3633e0c767d2b2b78fd4dab5caf39772a70fa
SHA512 0228abedbc582929702f45638db28a8c60c83f67e74592ce12e677dfb26d790ac063d94efd416fdcd15b8676d3716f495d060c759e3abe7b7c684b76c6245bda
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 202a2cd7731d3cf7aa1a6b0c5f129ebbb3fb4c8df33b6ca563a39460b375d025
MD5 096f21577e88d795c8aa499dd42b90a1
SHA1 7b0beb8881828a5e8bfba13ae9d711c88e03aa14
SHA512 6be2297db5774cd09f317c7d134fcffb5bd983ff4a1340c438d5eeaa1c99f7bb0ea313fe4b0cfe300e55066ffee96d1010ac93f550fa63dc76e3d1a2f4763731
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 80508ab2f9eeb19a71767403cd708f7436163076957f5d8177325ff8c862c28a
MD5 88f30ff435bf3e3f5e089d7b6fb3fdb1
SHA1 073d0030c083a2035de5c56fb141a4c25fde63d2
SHA512 6a8953ed421b2397fb66411a007959aa0a5b68601a26c2eb5b9afc1e35f83e1480a54a5597b2c152e7e402c49f945ab086cf8514394c3f570603f64cf329beed
SSDEEP 96:nAkR21m72wpvWMoiVmdeHk4NbUWQyV+VDCziEwb:nAkE872GWMXXbro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fdf64485005c4fa36bade0bb518b9f5a25b66feeac128a3494adfb8ded5001e7
MD5 26d59b0fb6e03c39b20646ae3c9ead4c
SHA1 0dc16d9cb4fd77d6f5ffdf7a145ff8b2e960cb0d
SHA512 965d747432623afde0c988c5c5853b3959d60726c4a08b54b07426a4e662f7dc9ae7d4f11d0d3077672140a212ac911fd655a5cb126c58ed2288d5a6f61db81b
SSDEEP 96:nAk821m72wpvWMoiVmdee1azEv3ErBk1Q2k4NbUWQyV+VDCAiEwb:nAkH872GWMuYYv3ErBk1Q2XbrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b2b7f1b205e2da654195ce0b586594842c6fb4809e5dc6ea2c343394ffc8d245
MD5 393324b975c76433e358a643f946f10c
SHA1 d13723c46cdf4ce8f7e2693c4c03f1d0421175ad
SHA512 68fae820d783e89b7143a40e65eac0b11b158b18a307aea60d0a69c9b8b631a96cf36907703b8a9f0da7820904b8e2867d445a9102e97d542ccf0507c0c78dc9
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupd9gme2RUh2y4Vm3z2OMDCr:A9iIxuERzA83h09RZxYP5CImaOMWRHqa
MD5 SHA1 SHA512 SSDEEP

Submit Download