823ca02b35649005c245d8eb04e65531118b72bd3c75bf8115f34d52650ec6b8

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9129ce40956763727a5a633454289cdb_JaffaCakes118.html
Size 34KB
Sample240603-km5basaf65
SHA256 823ca02b35649005c245d8eb04e65531118b72bd3c75bf8115f34d52650ec6b8
MD5 9129ce40956763727a5a633454289cdb
SHA1 4389195f9f2fbcfae3afd5ab9e87c385275713aa
SHA512 351f9ebb791c498141e5f4477344c6885ef4424334b9879e68fcbe5c63c90917db5f4e15878df4c7ee946029f4863b178f7b2fb5cdc8bc11e6ca3aed860d7a0b
SSDEEP 768:F7ZQv1l9QyYXRJEfZklFPVXOi02KkkN122+DMCgkvzWZcKDd:Fav1l9QyYXRgi0KkN1v+DMfkvzWZcKDd
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
3096	msedge.exe
3096	msedge.exe
880	identity_helper.exe
880	identity_helper.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 1924	3096	msedge.exe	83
PID 3096 wrote to memory of 1924	3096	msedge.exe	83
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 1148	3096	msedge.exe	84
PID 3096 wrote to memory of 4260	3096	msedge.exe	85
PID 3096 wrote to memory of 4260	3096	msedge.exe	85
PID 3096 wrote to memory of 4868	3096	msedge.exe	86
PID 3096 wrote to memory of 4868	3096	msedge.exe	86
PID 3096 wrote to memory of 4868	3096	msedge.exe	86
PID 3096 wrote to memory of 4868	3096	msedge.exe	86
PID 3096 wrote to memory of 4868	3096	msedge.exe	86
PID 3096 wrote to memory of 4868	3096	msedge.exe	86
PID 3096 wrote to memory of 4868	3096	msedge.exe	86
PID 3096 wrote to memory of 4868	3096	msedge.exe	86
PID 3096 wrote to memory of 4868	3096	msedge.exe	86
PID 3096 wrote to memory of 4868	3096	msedge.exe	86
PID 3096 wrote to memory of 4868	3096	msedge.exe	86
PID 3096 wrote to memory of 4868	3096	msedge.exe	86
PID 3096 wrote to memory of 4868	3096	msedge.exe	86
PID 3096 wrote to memory of 4868	3096	msedge.exe	86
PID 3096 wrote to memory of 4868	3096	msedge.exe	86
PID 3096 wrote to memory of 4868	3096	msedge.exe	86
PID 3096 wrote to memory of 4868	3096	msedge.exe	86
PID 3096 wrote to memory of 4868	3096	msedge.exe	86
PID 3096 wrote to memory of 4868	3096	msedge.exe	86
PID 3096 wrote to memory of 4868	3096	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9129ce40956763727a5a633454289cdb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa82fd46f8,0x7ffa82fd4708,0x7ffa82fd4718
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,12034365624284113772,14032011992457941136,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,12034365624284113772,14032011992457941136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,12034365624284113772,14032011992457941136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12034365624284113772,14032011992457941136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12034365624284113772,14032011992457941136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,12034365624284113772,14032011992457941136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,12034365624284113772,14032011992457941136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12034365624284113772,14032011992457941136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12034365624284113772,14032011992457941136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2480 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12034365624284113772,14032011992457941136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12034365624284113772,14032011992457941136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,12034365624284113772,14032011992457941136,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5184 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 99c3e6552c07c3c254daa6b801ccd5eca4d43b51c4688944c35bdb0bcb23673c
MD5 81d9272e5a77d09e17c4f5d94a0142ad
SHA1 1b76f69262b9e5e3583fde94f8fabc7854dbbf77
SHA512 476b4122d6538bc17c6d5b3f7af9e58f7e3af485b8f3fa3f9f2c1ebcf92300017ee7d8304f4a2030ecf06dec3a534cf7495b4199e4017606af606125854e73a3
SSDEEP 96:nkkRI1prEj0wpvWMoiVmdeHmQIGvUWQyV+VDCziEwb:nkkiPrEj0GWMXHro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5f7c42531fd252fea72c470c238320d7068b0bcd4173703d96275d42c2c45148
MD5 dc914945ca5fc4023f2ae990d6e3e1f1
SHA1 d900c7fb08a3c9cfd02b0179b5cb3c87e995f568
SHA512 d153c96df1bf8cd9342eac2db3aae8e61112fb6295fe90f1873705f18a71aedd1d0abfccd9120bc670cb6b1afee54a2b6936a4a50b24f110d86b755cf4200d39
SSDEEP 96:nkk8I1pr/j0wpvWMoiVmdeHmQ6FGvUWQyV+VD7AiEwb:nkk1Pr/j0GWMXlrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 663d11a2421c9730ee092a319675f8e0ea62a5d24bb4bb18a89419acd8116d37
MD5 da4274be460ed35d086c128f7add98bd
SHA1 44e4b27cfd67ac619b4c342b3cde4006b7a9adc2
SHA512 783147399b562384df2c3b03b46ff2199512ce19a33fd6b026106013720d113837d1b839343c0c0f60f53c3c7b30fa9165afd9f55f96de8b60a2e872d5300859
SSDEEP 96:nkk8I1prEj0wpvWMoiVmdeHmQIGvUWQyV+VDCAiEwb:nkk1PrEj0GWMXHrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 87d6dbf18d0a8f62fc7a9310ee94266ed9b7d6d3dc2dcf4cdf37e35ff90be59f
MD5 66663b7f12954628fac90634fd9e3283
SHA1 7856febf1fb1e32a20406e60f291399706bf7957
SHA512 dbd13e7f2e03fecce94f4d81f2dbfdbcc3b47bf73cbd71a06ffad4fc324036b1fc8238c0a6a07978ac34a7fdb0179fcc856485eeee63f0a12594598fd971f22c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupTQe2RUrPIKb1fYOxhZHnqL:A9iIxuERzA83h09RZxYTOWtJxTHqTMTu
MD5 SHA1 SHA512 SSDEEP

Submit Download