c9068f5be7e7601e7e3356342dde96daaade937a18e61acd8661f0bed6770a3c

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 09:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91459f82cb32a0ffc389ea611881d952_JaffaCakes118.html
Size 2KB
Sample240603-lcwf3sbc48
SHA256 c9068f5be7e7601e7e3356342dde96daaade937a18e61acd8661f0bed6770a3c
MD5 91459f82cb32a0ffc389ea611881d952
SHA1 abfad544deaf1ad61fd154fa7a000bf2312efa1c
SHA512 93df50e69a1c71ee3203773132a34b5e016f08aebdcad8bee5732b1eda87a7e62295c1c126ee83293325d4ee8512aa6d60123b0651b038056206f9d967ac9e17
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3548	msedge.exe
3548	msedge.exe
3888	msedge.exe
3888	msedge.exe
4152	identity_helper.exe
4152	identity_helper.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 2252	3888	msedge.exe	82
PID 3888 wrote to memory of 2252	3888	msedge.exe	82
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 2264	3888	msedge.exe	83
PID 3888 wrote to memory of 3548	3888	msedge.exe	84
PID 3888 wrote to memory of 3548	3888	msedge.exe	84
PID 3888 wrote to memory of 2856	3888	msedge.exe	85
PID 3888 wrote to memory of 2856	3888	msedge.exe	85
PID 3888 wrote to memory of 2856	3888	msedge.exe	85
PID 3888 wrote to memory of 2856	3888	msedge.exe	85
PID 3888 wrote to memory of 2856	3888	msedge.exe	85
PID 3888 wrote to memory of 2856	3888	msedge.exe	85
PID 3888 wrote to memory of 2856	3888	msedge.exe	85
PID 3888 wrote to memory of 2856	3888	msedge.exe	85
PID 3888 wrote to memory of 2856	3888	msedge.exe	85
PID 3888 wrote to memory of 2856	3888	msedge.exe	85
PID 3888 wrote to memory of 2856	3888	msedge.exe	85
PID 3888 wrote to memory of 2856	3888	msedge.exe	85
PID 3888 wrote to memory of 2856	3888	msedge.exe	85
PID 3888 wrote to memory of 2856	3888	msedge.exe	85
PID 3888 wrote to memory of 2856	3888	msedge.exe	85
PID 3888 wrote to memory of 2856	3888	msedge.exe	85
PID 3888 wrote to memory of 2856	3888	msedge.exe	85
PID 3888 wrote to memory of 2856	3888	msedge.exe	85
PID 3888 wrote to memory of 2856	3888	msedge.exe	85
PID 3888 wrote to memory of 2856	3888	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91459f82cb32a0ffc389ea611881d952_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90ebc46f8,0x7ff90ebc4708,0x7ff90ebc4718
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,481354956986825225,8312313870028820221,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,481354956986825225,8312313870028820221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,481354956986825225,8312313870028820221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,481354956986825225,8312313870028820221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,481354956986825225,8312313870028820221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,481354956986825225,8312313870028820221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,481354956986825225,8312313870028820221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,481354956986825225,8312313870028820221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,481354956986825225,8312313870028820221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,481354956986825225,8312313870028820221,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,481354956986825225,8312313870028820221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,481354956986825225,8312313870028820221,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,481354956986825225,8312313870028820221,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
MD5 c9c4c494f8fba32d95ba2125f00586a3
SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a7aa194aaebe36dfe8a8c35412da70ea3279571280568aef726f485549433bbf
MD5 e5ff9394a6179b4f876027281f6d625d
SHA1 4d3a21f6d700af7a4154ff7050d443799674b84d
SHA512 4dece7e6e9e244c62e027ffc40dce89f6f54a21c1441ae4326caa81a9d8c645c31d15b023a29a8bed77fa13f39082ba7641a8b8aea0925b2f4d04911e34cb203
SSDEEP 96:nGksx1lthwpvWMoiVmdeHm0wUWQyV+VDCziEwb:nGkMDthGWMXUro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 caa4ffe63d9045fc8cb4fcf3b9461d33a80db1dd5adc93f3a986fef21d182741
MD5 ff1edc76a32b73c65728c0f7cf59b904
SHA1 ea2c5b6a3a5fe9fec06edf53b22a443e170799c1
SHA512 e20d0bde2fd087717fcb2bf15b02f31b6e1303c949ec5d1d7a614bf373e1c2161801137fa4734214fcc90ac46f69e7827f275ac4920de588ec7dc71a7386f4da
SSDEEP 96:nGkXx1lthwpvWMoiVmdeHm0wUWQyV+VD7AiEwb:nGkBDthGWMXUrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 93467acd93a4328834634a0ec515c632cf3fddd00d0ee3acb3e44265309f972e
MD5 b1621ff4f552a0966737dee300d44620
SHA1 4e0d6077ad3da538973597f04fe2d3e71c3af1eb
SHA512 7f75e72143eec7a82b44124ca51592cb6daee3b39a76ed98f20a6e587e60303c432d82842b4b75d34ed013ff31f2fe46db274b1de0e2e0a958074bf7921444bb
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRGe2RUH0ezj3z2OMDCRHqa:A9iIxuERzA83h09RZxYS6jaOMWRHqlW9
MD5 SHA1 SHA512 SSDEEP

Submit Download