54d269c376d7e2b1db4e3a1afdeada8593f1f2da8313a0908dd49823db4ccc71

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
914359fd537a71294f62c403186f2263_JaffaCakes118.html
Size 30KB
Sample240603-la97fsaa21
SHA256 54d269c376d7e2b1db4e3a1afdeada8593f1f2da8313a0908dd49823db4ccc71
MD5 914359fd537a71294f62c403186f2263
SHA1 6b42080aa3443491f317a7765ed0104494c043b3
SHA512 6f8e87fa2ec8872e4e536f89a5bc52dbfba57176a7db0f9dcda0729c060ee62b719c96fb971240690d9aff277bf2626b1284d09469fb96b990d7edbd13522bbc
SSDEEP 768:ARBf0SqfuD5dEtNsQZoXnS7J40YkswThoizVW1:ARBf0SqfujEteaswTw1
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
3800	msedge.exe
3800	msedge.exe
4084	identity_helper.exe
4084	identity_helper.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 1324	3800	msedge.exe	84
PID 3800 wrote to memory of 1324	3800	msedge.exe	84
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 1316	3800	msedge.exe	85
PID 3800 wrote to memory of 4952	3800	msedge.exe	86
PID 3800 wrote to memory of 4952	3800	msedge.exe	86
PID 3800 wrote to memory of 3640	3800	msedge.exe	87
PID 3800 wrote to memory of 3640	3800	msedge.exe	87
PID 3800 wrote to memory of 3640	3800	msedge.exe	87
PID 3800 wrote to memory of 3640	3800	msedge.exe	87
PID 3800 wrote to memory of 3640	3800	msedge.exe	87
PID 3800 wrote to memory of 3640	3800	msedge.exe	87
PID 3800 wrote to memory of 3640	3800	msedge.exe	87
PID 3800 wrote to memory of 3640	3800	msedge.exe	87
PID 3800 wrote to memory of 3640	3800	msedge.exe	87
PID 3800 wrote to memory of 3640	3800	msedge.exe	87
PID 3800 wrote to memory of 3640	3800	msedge.exe	87
PID 3800 wrote to memory of 3640	3800	msedge.exe	87
PID 3800 wrote to memory of 3640	3800	msedge.exe	87
PID 3800 wrote to memory of 3640	3800	msedge.exe	87
PID 3800 wrote to memory of 3640	3800	msedge.exe	87
PID 3800 wrote to memory of 3640	3800	msedge.exe	87
PID 3800 wrote to memory of 3640	3800	msedge.exe	87
PID 3800 wrote to memory of 3640	3800	msedge.exe	87
PID 3800 wrote to memory of 3640	3800	msedge.exe	87
PID 3800 wrote to memory of 3640	3800	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\914359fd537a71294f62c403186f2263_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa597346f8,0x7ffa59734708,0x7ffa59734718
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,1368375996668858088,8529628491485365757,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,1368375996668858088,8529628491485365757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,1368375996668858088,8529628491485365757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1368375996668858088,8529628491485365757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1368375996668858088,8529628491485365757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,1368375996668858088,8529628491485365757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,1368375996668858088,8529628491485365757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1368375996668858088,8529628491485365757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1368375996668858088,8529628491485365757,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1368375996668858088,8529628491485365757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1368375996668858088,8529628491485365757,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,1368375996668858088,8529628491485365757,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 45f29c27c73e05338f453adc369bf78c4cb73bfe8cc194bf6dd6c70c10d57daa
MD5 2de825dde20e2d441bdfd6d5d48984f7
SHA1 18c941968445c97c03e00a5f1abc65e6fdfa2228
SHA512 f62f4a3e4f5de9fede2e94dcd510724f18a95f345523073aa61a063aca276e9a52f97c08904724ab7c2a403d06c9427e64df71bafa613b80ec8253c1f141aec0
SSDEEP 96:nZfkoc1qn3wpvWMoiVmdeHplwttacRUWQyV+VDCziEwb:nZfkhs3GWMXpQXRro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1c99fefef3c0e6dfae99e25ea846b4ce58b5c457c32c233f5e271b246ccb2da3
MD5 f9eeded48f33ca3dce89df5ac6f961c5
SHA1 d4cd871c7d1e6519a10cef8704b28c008783cb5b
SHA512 0f66b137db7274d1917f451290a4b779beeac2134e2b5173749a852d0d7b220263d727834252c09739bf83b7b2f2859f64f442f80d4439eaf746319550f20ef3
SSDEEP 96:nZfkDc1qR3wpvWMoiVmdeHplwttacRUWQyV+VD7AiEwb:nZfkIs1GWMXpQXRrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 df4f6934f1f3f0264105ccfbe13de57d569d90b70cd838b98698de2e107deb6e
MD5 acc56d27b369d897bb7f630e9c114f8c
SHA1 27a65204b17ff69c39a76126f76cf6a4afe0a5a0
SHA512 04ff0fa6c52e24c564fc05e2d2c1bd704c9223fe9d0dcd8908e911c5a016c6bc3dfc44d868a4269ea5d2373bdef035229cd711ade89ff4d75beae02df740c57f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuprSqe2RULj2Z03z2OMDCRHX:A9iIxuERzA83h09RZxYlQK0aOMWRHqlI
MD5 SHA1 SHA512 SSDEEP

Submit Download