3f72fdb579b5f77ac064a59d8bcb517668f559a284a72a06289dd98b06346ea8

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
913b2793d7cb8c9bfe41852d9a8f739d_JaffaCakes118.html
Size 29KB
Sample240603-k326waba57
SHA256 3f72fdb579b5f77ac064a59d8bcb517668f559a284a72a06289dd98b06346ea8
MD5 913b2793d7cb8c9bfe41852d9a8f739d
SHA1 e0284f39cf69c4d690ffb7b43d54bc0ab600008d
SHA512 2f6b3e636844f1273b003fc4f2a6ee33b60551e116179f59b21cb41f3e3c61f63221b35aa7a4de51a202929d2478beb09bf81f7d8e9628408f7e2e138162c551
SSDEEP 192:uWDbb5n69nQjxn5Q/VnQieANnynQOkEnt3znQTbnBnQ5MC5ANH+OhgamdMZR9BLK:bQ/mXq1xZ7BLP9QjfkisczO6l
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
2600	msedge.exe
2600	msedge.exe
3376	identity_helper.exe
3376	identity_helper.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 3352	2600	msedge.exe	83
PID 2600 wrote to memory of 3352	2600	msedge.exe	83
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3244	2600	msedge.exe	84
PID 2600 wrote to memory of 3516	2600	msedge.exe	85
PID 2600 wrote to memory of 3516	2600	msedge.exe	85
PID 2600 wrote to memory of 4048	2600	msedge.exe	86
PID 2600 wrote to memory of 4048	2600	msedge.exe	86
PID 2600 wrote to memory of 4048	2600	msedge.exe	86
PID 2600 wrote to memory of 4048	2600	msedge.exe	86
PID 2600 wrote to memory of 4048	2600	msedge.exe	86
PID 2600 wrote to memory of 4048	2600	msedge.exe	86
PID 2600 wrote to memory of 4048	2600	msedge.exe	86
PID 2600 wrote to memory of 4048	2600	msedge.exe	86
PID 2600 wrote to memory of 4048	2600	msedge.exe	86
PID 2600 wrote to memory of 4048	2600	msedge.exe	86
PID 2600 wrote to memory of 4048	2600	msedge.exe	86
PID 2600 wrote to memory of 4048	2600	msedge.exe	86
PID 2600 wrote to memory of 4048	2600	msedge.exe	86
PID 2600 wrote to memory of 4048	2600	msedge.exe	86
PID 2600 wrote to memory of 4048	2600	msedge.exe	86
PID 2600 wrote to memory of 4048	2600	msedge.exe	86
PID 2600 wrote to memory of 4048	2600	msedge.exe	86
PID 2600 wrote to memory of 4048	2600	msedge.exe	86
PID 2600 wrote to memory of 4048	2600	msedge.exe	86
PID 2600 wrote to memory of 4048	2600	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\913b2793d7cb8c9bfe41852d9a8f739d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c0ef46f8,0x7ff8c0ef4708,0x7ff8c0ef4718
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,5685292740511115567,16133941999054321679,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,5685292740511115567,16133941999054321679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,5685292740511115567,16133941999054321679,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5685292740511115567,16133941999054321679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5685292740511115567,16133941999054321679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,5685292740511115567,16133941999054321679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,5685292740511115567,16133941999054321679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5685292740511115567,16133941999054321679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5685292740511115567,16133941999054321679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5685292740511115567,16133941999054321679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5685292740511115567,16133941999054321679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,5685292740511115567,16133941999054321679,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4684 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 10378551b6cdfefedbc13141fbc938d40895077704fb7210432f674bec2f9d6e
MD5 435afb253d96c33836e309afa201b319
SHA1 c8068137fd3e37186d6297b1656b4a5886649dda
SHA512 c649c4f13b9d0f20549ad28c4394ed01e7dcd89d08f6aeee32851dab427272b7a70c9f7c3a645099b3d67860abdfb3ec816994d376cac14dc46015bed9277e49
SSDEEP 96:n3kRo1i8juwpvWMoiVmdeHvSS9UWQyV+VDCziEwb:n3k688juGWMX7ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a2f45ce46f38b19874880e0a8265da3c71a65ffe44189b8014d0a688c36b9fb9
MD5 f43c7eb3d352a6c26e730de1970be5c7
SHA1 8b1e4907c44bd5a9e1711851c316182e074d703e
SHA512 08d7e71d8fba559acbe287921c56f9db7fdff4a9bd252eac926ebb7667a96ad7dcd40d3905d729b8cd9c8de21de49dc908cb93009c9e497f9ac2123af89acf82
SSDEEP 96:n3k8o1izjuwpvWMoiVmdeHvSS9UWQyV+VDCAiEwb:n3k18zjuGWMX7rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 93284c90b52771de1fd7030370759f34bbdc310298965cdbb1eff90d705fbfd5
MD5 cedb62ddaf2d49c9aa4d239c408d5664
SHA1 fb1706c0f9a531fe27707a1ca9fb7b2030ae863b
SHA512 fd3d103a87a6f8d1ee24b1207d9aaca80df6e417f788ca49ff25add5f50638a567de2f80970458b9079064adc09d92ec35f0a12cfd2d4a91d84fe409b04d7240
SSDEEP 96:n3k8o1i8juwpvWMoiVmdeHvSS9UWQyV+VDCAiEwb:n3k188juGWMX7rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 503fcf902bab95ab91db473ada608af97792de8ea4f8553fbe2d83f526b7de2b
MD5 01d8edf4d38c1c16b4ab95e20b874375
SHA1 433c73899f92c7cd096c7a8b7889b7c73a1f44ea
SHA512 508582b5a82c3756441439eca48e65d584b45f91e288798bdf6aab01754ef46912d4c2a670976a94992343810e1c5eee981bf13f805dd95efe58cf8e1de7b285
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupqBe2RUrRua3z2OMDCRHqlT:A9iIxuERzA83h09RZxYqVlaaOMWRHqlT
MD5 SHA1 SHA512 SSDEEP

Submit Download