86f42acbedd1a3ed80ae492dda805b4ebf5ed1b9972b0a4e6ce7ae45ff88fea1

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
912e4e4f359ed5a3621d623baefda2a0_JaffaCakes118.html
Size 26KB
Sample240603-krvbwsag58
SHA256 86f42acbedd1a3ed80ae492dda805b4ebf5ed1b9972b0a4e6ce7ae45ff88fea1
MD5 912e4e4f359ed5a3621d623baefda2a0
SHA1 0557e752e1b3f0d169222124df038e3f7158310d
SHA512 5da09e8e9ecd17556415c5de032b7c4a060b9641f8a5aef6d205530e9e098a6a34fe9ca05679f054127b1999c3c42b9a92742319a3df6a205991156c62b390fc
SSDEEP 192:uqE7jmb5nQGnQjxn5Q/znQieyNnvnQOkEntRlnQTbnpnQwCJVevo7NtJFo+NzQ4X:nqQ/0ygcqw8a
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
4700	msedge.exe
4700	msedge.exe
3812	identity_helper.exe
3812	identity_helper.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 1144	4700	msedge.exe	83
PID 4700 wrote to memory of 1144	4700	msedge.exe	83
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 3828	4700	msedge.exe	84
PID 4700 wrote to memory of 2384	4700	msedge.exe	85
PID 4700 wrote to memory of 2384	4700	msedge.exe	85
PID 4700 wrote to memory of 2264	4700	msedge.exe	86
PID 4700 wrote to memory of 2264	4700	msedge.exe	86
PID 4700 wrote to memory of 2264	4700	msedge.exe	86
PID 4700 wrote to memory of 2264	4700	msedge.exe	86
PID 4700 wrote to memory of 2264	4700	msedge.exe	86
PID 4700 wrote to memory of 2264	4700	msedge.exe	86
PID 4700 wrote to memory of 2264	4700	msedge.exe	86
PID 4700 wrote to memory of 2264	4700	msedge.exe	86
PID 4700 wrote to memory of 2264	4700	msedge.exe	86
PID 4700 wrote to memory of 2264	4700	msedge.exe	86
PID 4700 wrote to memory of 2264	4700	msedge.exe	86
PID 4700 wrote to memory of 2264	4700	msedge.exe	86
PID 4700 wrote to memory of 2264	4700	msedge.exe	86
PID 4700 wrote to memory of 2264	4700	msedge.exe	86
PID 4700 wrote to memory of 2264	4700	msedge.exe	86
PID 4700 wrote to memory of 2264	4700	msedge.exe	86
PID 4700 wrote to memory of 2264	4700	msedge.exe	86
PID 4700 wrote to memory of 2264	4700	msedge.exe	86
PID 4700 wrote to memory of 2264	4700	msedge.exe	86
PID 4700 wrote to memory of 2264	4700	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\912e4e4f359ed5a3621d623baefda2a0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97d9546f8,0x7ff97d954708,0x7ff97d954718
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,5873118902914217230,5832700681289032146,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,5873118902914217230,5832700681289032146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,5873118902914217230,5832700681289032146,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5873118902914217230,5832700681289032146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5873118902914217230,5832700681289032146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,5873118902914217230,5832700681289032146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,5873118902914217230,5832700681289032146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5873118902914217230,5832700681289032146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5873118902914217230,5832700681289032146,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5873118902914217230,5832700681289032146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5873118902914217230,5832700681289032146,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,5873118902914217230,5832700681289032146,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3436 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 dd75bc795121a985344a36097e348ab7e90ecfe7955c2b8e4d3c05c8eb4c6747
MD5 059af1da4f6a6b4932c8e3b10cd15468
SHA1 be5a1305223d81b86bb55273927b4e197dd3dcd4
SHA512 2687145cb99610ac7509814a420e0bf07a3fb49f13a8bc6b7d175a27f6bda87f659140e5fe1663543a54a3e7f3f83c0239b5d8c739926aed17f87a0c3038f97b
SSDEEP 96:nAkLD1vdBJwpvWMoiVmdeHBrzPUWQyV+VDCziEwb:nAkfldBJGWMXZro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 56c444b0a39a408fe9445be6c2d594200c74b2aaad4eee087af75ad08451eae8
MD5 4e293608cfaefb6f943af780b7b67594
SHA1 f442c9c5bbe0c7eb580d91cce84fb527122147a4
SHA512 85109cee500a5ab43346e99eb014a1f7cc7da165e71a8e83eefb0a912c1dfe43c521d85988c571bea74d601954132b6a9b8de037fd14bab57eaddb78588d6e1f
SSDEEP 96:nAkiD1vdB7wpvWMoiVmdeHBrzPUWQyV+VDCAiEwb:nAkgldB7GWMXZrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 49678d72b908cc2c1712673dabfcbf79d24ac2c57572837940b8f89d71c8a59a
MD5 a6aa0acee9025d496f6d83f8df53b486
SHA1 8bbf8934fe2d40329cec47ed1f48882400259421
SHA512 6b9d72787e6b79d71e6852c8fb38be186a78783e41daff670bd382b0fe1504115fbfefdbe5d988ef78d26e1f0ec5808edc9efeb611c976a3132fb4e4609c2967
SSDEEP 96:nAkiD1vdBJwpvWMoiVmdeHBrzPUWQyV+VDCAiEwb:nAkgldBJGWMXZrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6684f659c2784f2085ecf5b73b5880867897cc48ee24b6383ddee97f2c32f8f5
MD5 a833c9b8cc689df16bc1a85e7785d273
SHA1 0a8f10c96a1bf03b9dd02ba8c960b2671990088a
SHA512 02eb092489c32d5721625b22d7146ed12f23e916a2657b0748a4fbb1d5574f7dd3bba3cb3e3f5a095a13d2de2b9f937765f20ed9eeb782e0924e447d1f1dbcaa
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup84HD6e2RU5Mj2T3z2OMDCV:A9iIxuERzA83h09RZxYzHDU3yTaOMWRz
MD5 SHA1 SHA512 SSDEEP

Submit Download