caaadbc00888c4cc9d0c66e6873a62ec6380868d2c9b2fd1eb81712f7c51b016

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
912b1405a0dea9f85fe32b7ea45ab0d5_JaffaCakes118.html
Size 36KB
Sample240603-kn2xkaaf83
SHA256 caaadbc00888c4cc9d0c66e6873a62ec6380868d2c9b2fd1eb81712f7c51b016
MD5 912b1405a0dea9f85fe32b7ea45ab0d5
SHA1 d325c27a2ead97e7ed9dcd989fb61da2ae5b7431
SHA512 f16b8e9531255de887e9b52767b3938002681a1c1fcc8adb277021f33d89be62703536488e231163159cba23ff3fd98d36f3b2b61e3a1b665eeb5b091784602a
SSDEEP 768:zwx/MDTHWI88hARmZPXZE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6T+ZOk6u3l56lLR+:Q/nbJxNVAufSI/t8ZK
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
4888	msedge.exe
4888	msedge.exe
4924	identity_helper.exe
4924	identity_helper.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 1416	4888	msedge.exe	81
PID 4888 wrote to memory of 1416	4888	msedge.exe	81
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 1132	4888	msedge.exe	82
PID 4888 wrote to memory of 3052	4888	msedge.exe	83
PID 4888 wrote to memory of 3052	4888	msedge.exe	83
PID 4888 wrote to memory of 772	4888	msedge.exe	84
PID 4888 wrote to memory of 772	4888	msedge.exe	84
PID 4888 wrote to memory of 772	4888	msedge.exe	84
PID 4888 wrote to memory of 772	4888	msedge.exe	84
PID 4888 wrote to memory of 772	4888	msedge.exe	84
PID 4888 wrote to memory of 772	4888	msedge.exe	84
PID 4888 wrote to memory of 772	4888	msedge.exe	84
PID 4888 wrote to memory of 772	4888	msedge.exe	84
PID 4888 wrote to memory of 772	4888	msedge.exe	84
PID 4888 wrote to memory of 772	4888	msedge.exe	84
PID 4888 wrote to memory of 772	4888	msedge.exe	84
PID 4888 wrote to memory of 772	4888	msedge.exe	84
PID 4888 wrote to memory of 772	4888	msedge.exe	84
PID 4888 wrote to memory of 772	4888	msedge.exe	84
PID 4888 wrote to memory of 772	4888	msedge.exe	84
PID 4888 wrote to memory of 772	4888	msedge.exe	84
PID 4888 wrote to memory of 772	4888	msedge.exe	84
PID 4888 wrote to memory of 772	4888	msedge.exe	84
PID 4888 wrote to memory of 772	4888	msedge.exe	84
PID 4888 wrote to memory of 772	4888	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\912b1405a0dea9f85fe32b7ea45ab0d5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1fe446f8,0x7fff1fe44708,0x7fff1fe44718
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,4923029912400557499,14148158044867748334,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,4923029912400557499,14148158044867748334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,4923029912400557499,14148158044867748334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4923029912400557499,14148158044867748334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4923029912400557499,14148158044867748334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,4923029912400557499,14148158044867748334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,4923029912400557499,14148158044867748334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4923029912400557499,14148158044867748334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4923029912400557499,14148158044867748334,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4923029912400557499,14148158044867748334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4923029912400557499,14148158044867748334,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,4923029912400557499,14148158044867748334,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 614B
SHA256 dd5c612673435c72542a628d852cf7bc9a15a4ae5b8db58fd3738bb07c566adc
MD5 704176821689c7efb2eb9b4cbcfb2677
SHA1 772bd3f4020f7c8a8744691153923a5a6d8cf808
SHA512 0a1ebd2b3a4c7f26e82d767fdf9d504273aa902768fd7d7c31642aa3f03e23edb47d2998234423ffc007e7b3190d458263d5edac89f611fe3401f449e197eb58
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b5317b6b5f623a0e1d408989f58b1344a94a6919176c05718dc31b370294b979
MD5 b95e5b219a317e8ed319807669e4130b
SHA1 58b2f791b03b5da2c432502a0129848d0f00b75a
SHA512 1ca570c8bd3b2a41210b0f48a5d988fbed9fac5883d05a1de2dcd11967749c52803cd213e31a111e710ff34d00c5d81d32526d5ac358b54f8a6dae7436194cdc
SSDEEP 96:nsakm8E1Fhmga9IQwpvWMoiVmdeHpCrbybhgUWQyV+VDCziEwb:nsakDEh1aCQGWMXpwybhgro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 afa5e5dade27e61cb5ce6cbdd1c82b37c87fa7d8652a00df5288080ddf69e6c7
MD5 09e6d990755d4a36fc5e898324e47747
SHA1 eb0a1b46c7eedeb65a7a15a37923e3671d601994
SHA512 41ec2914853bdbcc868479a0a00540eb8272001564beac8cad1ded5cda90fde1d6c2c3e2682666163f09aacb051af616acf40a0af9efa2af3c01fbc70d34100c
SSDEEP 96:nsak98E1Fh2ga9IQwpvWMoiVmdeEjDzv41e2pCrbybhgUWQyV+VD7AiEwb:nsakyEhlaCQGWMkDzA1e2pwybhgrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 a60087e15b568919d2e0dabd83b57b2352fe633b017cebcbe00d889051cc0639
MD5 63ccece3efc13c64f45a8942781284c9
SHA1 83c3549619be61e3f29e3c089b35bdde85fd7113
SHA512 aa132a9f69aaec37caf7cbede2dc81204179426b20b62d0f752264729f2d3b1f27844ecea1236ed1ce131963978f95b03b4269bfe3ad92ac7a8a4269686ae1e1
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupAckXge2RUWCFgjf7ZXD3z3:A9iIxuERzA83h09RZxYAckX+FCFUzZXH
MD5 SHA1 SHA512 SSDEEP

Submit Download