ad9776c6592ba2b72cb43f6ae4edbeb2f4758f13efbbca2222ec5c30c1fe7b99

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 09:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
913f285d93d3d612aa696b37045735d3_JaffaCakes118.html
Size 461KB
Sample240603-k7f47sbb33
SHA256 ad9776c6592ba2b72cb43f6ae4edbeb2f4758f13efbbca2222ec5c30c1fe7b99
MD5 913f285d93d3d612aa696b37045735d3
SHA1 77cacba48151ba3fd577d354e8c01eb01c9eaa93
SHA512 26b13eeaecc2b24b92be823dd80249fa5cdf70cfc81018af293258437e8e5cf31e995b0f86b89cd6acae0481f50a0dfc1cc1154c1a09ed3f88a81f2a60d8668d
SSDEEP 6144:SVsMYod+X3oI+YzsMYod+X3oI+YOsMYod+X3oI+YLsMYod+X3oI+YQ:W5d+X3h5d+X325d+X315d+X3+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3916	msedge.exe
3916	msedge.exe
2512	msedge.exe
2512	msedge.exe
4468	identity_helper.exe
4468	identity_helper.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 4640	2512	msedge.exe	82
PID 2512 wrote to memory of 4640	2512	msedge.exe	82
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 2904	2512	msedge.exe	83
PID 2512 wrote to memory of 3916	2512	msedge.exe	84
PID 2512 wrote to memory of 3916	2512	msedge.exe	84
PID 2512 wrote to memory of 1960	2512	msedge.exe	85
PID 2512 wrote to memory of 1960	2512	msedge.exe	85
PID 2512 wrote to memory of 1960	2512	msedge.exe	85
PID 2512 wrote to memory of 1960	2512	msedge.exe	85
PID 2512 wrote to memory of 1960	2512	msedge.exe	85
PID 2512 wrote to memory of 1960	2512	msedge.exe	85
PID 2512 wrote to memory of 1960	2512	msedge.exe	85
PID 2512 wrote to memory of 1960	2512	msedge.exe	85
PID 2512 wrote to memory of 1960	2512	msedge.exe	85
PID 2512 wrote to memory of 1960	2512	msedge.exe	85
PID 2512 wrote to memory of 1960	2512	msedge.exe	85
PID 2512 wrote to memory of 1960	2512	msedge.exe	85
PID 2512 wrote to memory of 1960	2512	msedge.exe	85
PID 2512 wrote to memory of 1960	2512	msedge.exe	85
PID 2512 wrote to memory of 1960	2512	msedge.exe	85
PID 2512 wrote to memory of 1960	2512	msedge.exe	85
PID 2512 wrote to memory of 1960	2512	msedge.exe	85
PID 2512 wrote to memory of 1960	2512	msedge.exe	85
PID 2512 wrote to memory of 1960	2512	msedge.exe	85
PID 2512 wrote to memory of 1960	2512	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\913f285d93d3d612aa696b37045735d3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84d7846f8,0x7ff84d784708,0x7ff84d784718
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,5557428175944664604,16313249468566118142,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,5557428175944664604,16313249468566118142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,5557428175944664604,16313249468566118142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5557428175944664604,16313249468566118142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5557428175944664604,16313249468566118142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,5557428175944664604,16313249468566118142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,5557428175944664604,16313249468566118142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5557428175944664604,16313249468566118142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5557428175944664604,16313249468566118142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5557428175944664604,16313249468566118142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5557428175944664604,16313249468566118142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,5557428175944664604,16313249468566118142,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5420 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2e2d91a0477cc7fc1440d9af0d09e15bd6f1584eb84722aa64a38b5b3543e8d5
MD5 87a857a366d4c2b058b9504cad1c8230
SHA1 446b9ff5809578b4834a32cdbdd838534dc16049
SHA512 5c7595bc9c9d55faed67571b8b9b519f9cd41c89b3dce36c831c7cd2ddfe54ef385f7ef1b3e0aafa3d3981e926033a145b6383440d681862c697cc97dffb5ae0
SSDEEP 96:npkOV1qwv3wpvWMoiVmdeHplwtvacsUWQyV+VDCziEwb:npk2tvGWMXpeXsro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 baca338f255c7f7174ccffaca0dc2d3e5efa4a239cbe4caeeae1f8e2833fb04c
MD5 619b61d04f301a8a608066f63a5390f4
SHA1 c08c078288667bde4e9890ab592da251d071f977
SHA512 0f19417f9d211481db0a17d474d5718410c28f17128f3cfea5aa3a99c150562b6fc7bc782d0a9c6cd989fff4e5e0e0c6ac0647869f3560c98b06bdd8e4c4b48d
SSDEEP 96:npkFV1qwC3wpvWMoiVmdeHplwtvacsUWQyV+VD7AiEwb:npk7tqGWMXpeXsrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 9e84ac9cff667dfa3a111cd3aab1a3b1ba203b0c36718cc94c29ddcc5e3170e0
MD5 078314814f8b54b35fabf8a0dee3462e
SHA1 d7e6bde0fdf975914d3c20c0ee066e8e848a8622
SHA512 899a93dc40274cd69e005ae14a16d051a6829b7db9873f3c55c4e95d645d5a29a447f9096cf3cf6ef7fbae5216bfafb6b5b13fcf1af75416b82c38d262017b3e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupEwe2RUT2ZMK3z2OMDCRHqz:A9iIxuERzA83h09RZxY73MKaOMWRHqlx
MD5 SHA1 SHA512 SSDEEP

Submit Download