eda3f1dbcc4807578b70bb743f0419531e756800b8ff24e26875facb31047761

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 07:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
90fbeb86f1659512d1517f88875bb4d0_JaffaCakes118.html
Size 22KB
Sample240603-jhlsqahe53
SHA256 eda3f1dbcc4807578b70bb743f0419531e756800b8ff24e26875facb31047761
MD5 90fbeb86f1659512d1517f88875bb4d0
SHA1 7dc45b515bd22e0e9e3c3c9d40062f9719928895
SHA512 ae05959849f1a65d875efcaaed772f11fddb4b89c6ac0818379a19183453bc23f7f209f813f7665b1a78112b82ffd76b7a4c7c80908bcf2455e2adbe3a26b2cf
SSDEEP 192:uwLdb5nYanQjxn5Q/HnQie+NnCnQOkEnth9nQTbntnQ6v06J4RnQNjMBeqnYnQ7B:QQ/pv06kEE
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
3228	msedge.exe
3228	msedge.exe
4428	identity_helper.exe
4428	identity_helper.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 4068	3228	msedge.exe	80
PID 3228 wrote to memory of 4068	3228	msedge.exe	80
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 4820	3228	msedge.exe	81
PID 3228 wrote to memory of 1344	3228	msedge.exe	82
PID 3228 wrote to memory of 1344	3228	msedge.exe	82
PID 3228 wrote to memory of 1852	3228	msedge.exe	83
PID 3228 wrote to memory of 1852	3228	msedge.exe	83
PID 3228 wrote to memory of 1852	3228	msedge.exe	83
PID 3228 wrote to memory of 1852	3228	msedge.exe	83
PID 3228 wrote to memory of 1852	3228	msedge.exe	83
PID 3228 wrote to memory of 1852	3228	msedge.exe	83
PID 3228 wrote to memory of 1852	3228	msedge.exe	83
PID 3228 wrote to memory of 1852	3228	msedge.exe	83
PID 3228 wrote to memory of 1852	3228	msedge.exe	83
PID 3228 wrote to memory of 1852	3228	msedge.exe	83
PID 3228 wrote to memory of 1852	3228	msedge.exe	83
PID 3228 wrote to memory of 1852	3228	msedge.exe	83
PID 3228 wrote to memory of 1852	3228	msedge.exe	83
PID 3228 wrote to memory of 1852	3228	msedge.exe	83
PID 3228 wrote to memory of 1852	3228	msedge.exe	83
PID 3228 wrote to memory of 1852	3228	msedge.exe	83
PID 3228 wrote to memory of 1852	3228	msedge.exe	83
PID 3228 wrote to memory of 1852	3228	msedge.exe	83
PID 3228 wrote to memory of 1852	3228	msedge.exe	83
PID 3228 wrote to memory of 1852	3228	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\90fbeb86f1659512d1517f88875bb4d0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb315a46f8,0x7ffb315a4708,0x7ffb315a4718
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,214431248534392888,17654115360145309093,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,214431248534392888,17654115360145309093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,214431248534392888,17654115360145309093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,214431248534392888,17654115360145309093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,214431248534392888,17654115360145309093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,214431248534392888,17654115360145309093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,214431248534392888,17654115360145309093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,214431248534392888,17654115360145309093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,214431248534392888,17654115360145309093,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,214431248534392888,17654115360145309093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,214431248534392888,17654115360145309093,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,214431248534392888,17654115360145309093,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
MD5 ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1 a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA512 e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
MD5 f53207a5ca2ef5c7e976cbb3cb26d870
SHA1 49a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA512 be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5d1ad3678ff2f4ce5f1bc7b2a86f7d027c94bd8c14b4fa5ea15cce2d2384e824
MD5 76a473e8d0f33bf058e9f42f1912b78d
SHA1 6b1fa2c54943286645e006266ee29e600374749e
SHA512 731db089c2b1185cba86519e394644b85288d17cb7f48c84e2f33790fbbede64f557cf7b409fb540d7589c21d565b32eac210532aa4ce3fdfddb753c98fcb4ff
SSDEEP 96:nSkMV1wPe8wpvWMoiVmdeHpw8E6AvUWQyV+VDCziEwb:nSkUWPe8GWMXpwNvro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e0950eb0213859bc3d92b134f3a32c7936c0047f3954aa35cef30233c3ba02a5
MD5 437563a1f87e39b73c2d16d39b39a4bb
SHA1 5dd9574f06a5695ef41daef7e6c247aaf5546e63
SHA512 2f1051205a076a60e46821291b273ef7b3b9cf1a20d9f9644fb417f2d428ea0b2127ff842e1bb5bcd4f9bf61a6e980614cac5dbf723b221527231246aa7db560
SSDEEP 96:nSk3V1w5e8wpvWMoiVmdeHpw8E6AvUWQyV+VDCAiEwb:nSkFW5e8GWMXpwNvrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f73a1ad4804b9456d19637b5288a983a3b1f420a3dc225c5b38fdbf897ff0777
MD5 33e4e01a013d38156d1690bfe7132b51
SHA1 ed611228ad9d676c533b4df869a22b835c3ac68c
SHA512 7ed597880519d01623730a2de33a409f5607b1035efa0485808b269a4fc7a3473b1a9928f5c5b4ed59b1905308e8362074bdfb0251d9dd6624ced3a029bc5c95
SSDEEP 96:nSk3V1wPe8wpvWMoiVmdeHpw8E6AvUWQyV+VDCAiEwb:nSkFWPe8GWMXpwNvrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 e812818b183e95026cb26a70e7f8383d792e57f94a945cb761eec9d4a48f3937
MD5 fd9d3fdc18a654d2e197e0f89374825d
SHA1 5fba0e1b38df13adff147a7f7f37a354fcd910f2
SHA512 93f0ecbe7ffab651394382bc4fc057b48521cef20cebb1093329f0328f02947e00b09b109e27cd42c9c77f826d6a4f70d807a74af0c61bb4398127d848fccbc4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupyMXe2RURJ+kS3z2OMDCRHS:A9iIxuERzA83h09RZxYFGSaOMWRHqlWs
MD5 SHA1 SHA512 SSDEEP

Submit Download