595834de98874589bdb2d3cb9b6d8d12fb8679f1b2413ee282029055e6c6d56b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 09:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
913f03e502e9463dcd4bcfa8e389bc68_JaffaCakes118.html
Size 361KB
Sample240603-k69ecsbb29
SHA256 595834de98874589bdb2d3cb9b6d8d12fb8679f1b2413ee282029055e6c6d56b
MD5 913f03e502e9463dcd4bcfa8e389bc68
SHA1 acd397fb1e7a8a8d24ad60eff1f472e43c71a777
SHA512 0710eb372db26a19bf0cf68365eac5905de08471427feb999af9954cb2a56bf70cf1bac4210308d36d8ef6db3e0588eab792ef59048e414e81b34dcc5f4305d9
SSDEEP 3072:Lnu2RE0bl2/K/CRh6T8/Z/BQhpI5e7oQgw6Rmt:3oQgw6Rmt
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
380	msedge.exe
380	msedge.exe
1540	identity_helper.exe
1540	identity_helper.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 936	380	msedge.exe	82
PID 380 wrote to memory of 936	380	msedge.exe	82
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 116	380	msedge.exe	83
PID 380 wrote to memory of 2368	380	msedge.exe	84
PID 380 wrote to memory of 2368	380	msedge.exe	84
PID 380 wrote to memory of 3512	380	msedge.exe	85
PID 380 wrote to memory of 3512	380	msedge.exe	85
PID 380 wrote to memory of 3512	380	msedge.exe	85
PID 380 wrote to memory of 3512	380	msedge.exe	85
PID 380 wrote to memory of 3512	380	msedge.exe	85
PID 380 wrote to memory of 3512	380	msedge.exe	85
PID 380 wrote to memory of 3512	380	msedge.exe	85
PID 380 wrote to memory of 3512	380	msedge.exe	85
PID 380 wrote to memory of 3512	380	msedge.exe	85
PID 380 wrote to memory of 3512	380	msedge.exe	85
PID 380 wrote to memory of 3512	380	msedge.exe	85
PID 380 wrote to memory of 3512	380	msedge.exe	85
PID 380 wrote to memory of 3512	380	msedge.exe	85
PID 380 wrote to memory of 3512	380	msedge.exe	85
PID 380 wrote to memory of 3512	380	msedge.exe	85
PID 380 wrote to memory of 3512	380	msedge.exe	85
PID 380 wrote to memory of 3512	380	msedge.exe	85
PID 380 wrote to memory of 3512	380	msedge.exe	85
PID 380 wrote to memory of 3512	380	msedge.exe	85
PID 380 wrote to memory of 3512	380	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\913f03e502e9463dcd4bcfa8e389bc68_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb263f46f8,0x7ffb263f4708,0x7ffb263f4718
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,1672071551928355544,10152231510520648802,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,1672071551928355544,10152231510520648802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,1672071551928355544,10152231510520648802,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1672071551928355544,10152231510520648802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1672071551928355544,10152231510520648802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,1672071551928355544,10152231510520648802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,1672071551928355544,10152231510520648802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1672071551928355544,10152231510520648802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1672071551928355544,10152231510520648802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1672071551928355544,10152231510520648802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2348 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1672071551928355544,10152231510520648802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,1672071551928355544,10152231510520648802,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
MD5 87f7abeb82600e1e640b843ad50fe0a1
SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 188B
SHA256 c3fdeb105b90eacca573ba56b3c14fa5a8690400884388cc0c789d20b9a4cd42
MD5 06b053870aeafb9626a3b5811ccd994a
SHA1 d88305e47ea47e234be3659546db33e5bfae8717
SHA512 f2b890bd469f7f2cbeebe1e3aa1c6ae5aa01d73e21b60a55cff405ee4bc236ab8d1d494b555772b2ec1370f5b508b1aa6edbaf30024df01910e28b4c40b66627
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 8b6c5883520a9e93b07d94327c0e8d6de6e44e7e283036d2332a56f67b0946ad
MD5 8c6d0eb49244d7af7129deb94f6ebed8
SHA1 35e2bd8df0bdbea78ef6c7bfb3f6f8ab8ebd3325
SHA512 10b85cf44e6707d420dc7aa29a851f6b4da44df2bad5784ce8a538685325a5e91aba7ac85de9d96cdf985a40841519ee54bfc6545c9eed2e7fe2d5ef27ad2bc2
SSDEEP 96:nNkRB1v7v0wpvWMoiVmdeH/zZo+UWQyV+VDCziEwb:nNkbx78GWMXS+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0852c8697b0710cd478bd239347ec24d3a91a0a01dfdd59d7829665a51d969d4
MD5 5675ca3fc4d696e09806d3943cd4d1bb
SHA1 e945963ddbd5ebfedb12b1ea5824c51ff4173929
SHA512 e0ca50ec160e3062c5701fb79e87ca1e1a8dcde54aa20b52203135f49f60c65b4ffca1a257108f8e9bc98188d136dcec07220551e3a6deea8c53f6b69b62d259
SSDEEP 96:nNk8B1v7v0wpvWMoiVmdeN2/zZo+UWQyV+VDCAiEwb:nNkMx78GWM92S+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 02d0d87d5ae144d3016e3e40e6394cc76048ca3be93ebbd6d0dd2796a7dd6a18
MD5 0c7e990ac5b49e09cef83406e2f689c1
SHA1 aaec638c04622b3fdc23691d2e02830c436aa078
SHA512 ddc74a98e42bc210f50d7b7f0a14b42de60681911225c63045d931113df815f16e390381f8f63f35360f9b2ae121ffc3578a8ac222ef8acff62ed956aee07c9c
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57e000.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e000.TMP
Size 203B
SHA256 4757dd1b00acf7af83feafae6ca39f9dd3e0325c803c240bb88d68b65ee9e1bd
MD5 1fb5e45bfd188ddf7b95beb3b2e01237
SHA1 e6fd6d18494c670cb8ee9f0de54c68f03fb0b343
SHA512 cc6494676a5c75a7f1d9a99244b0d63b069105b670b68d0fe13fe3265977b9b162b664f49f2cceff1f631806776a06d64c405d61f67ae2852aced087a0c101f0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5e5f6f7733330e2108ca349cb1737b0913f01f30062cd5c1eee360e2c3500fef
MD5 14ce9799365c3415217f297ba6d981dc
SHA1 37af7b99f81155c0ef31eff080a2353cd9703700
SHA512 afaf876b9fb59c7269eee3239eb81025716cb6fbb59d3252c3e9e52f427c075410ff4ad63e974a4548e8e025e9cf71465fed4d32ea88684a373f0e00b172b4ec
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup+vSe2RUnermyk3z2OMDCRG:A9iIxuERzA83h09RZxYwse2kaOMWRHqd
MD5 SHA1 SHA512 SSDEEP

Submit Download