abb829c1c4790eb1a42a73395b235661af16bc8339b0b26d4dc955f3bd6212de

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 09:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
914d4dd1aa6138f3a17f34819bbb96bb_JaffaCakes118.html
Size 3KB
Sample240603-lkvvhsbe59
SHA256 abb829c1c4790eb1a42a73395b235661af16bc8339b0b26d4dc955f3bd6212de
MD5 914d4dd1aa6138f3a17f34819bbb96bb
SHA1 5f9b14412909d2cb62c5bcc816c14848f8d7eba3
SHA512 9e1f8596bc897775add1671bfca77f1a79813f6bc7d3bb1490487a042737345be23b7a64cc7a3caaac71c2a9cec6655f81f9fae3186ece6e2932c2b2cfbf163a
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe
4920	msedge.exe
4920	msedge.exe
3228	identity_helper.exe
3228	identity_helper.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 5096	4920	msedge.exe	84
PID 4920 wrote to memory of 5096	4920	msedge.exe	84
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 3104	4920	msedge.exe	85
PID 4920 wrote to memory of 4612	4920	msedge.exe	86
PID 4920 wrote to memory of 4612	4920	msedge.exe	86
PID 4920 wrote to memory of 4720	4920	msedge.exe	87
PID 4920 wrote to memory of 4720	4920	msedge.exe	87
PID 4920 wrote to memory of 4720	4920	msedge.exe	87
PID 4920 wrote to memory of 4720	4920	msedge.exe	87
PID 4920 wrote to memory of 4720	4920	msedge.exe	87
PID 4920 wrote to memory of 4720	4920	msedge.exe	87
PID 4920 wrote to memory of 4720	4920	msedge.exe	87
PID 4920 wrote to memory of 4720	4920	msedge.exe	87
PID 4920 wrote to memory of 4720	4920	msedge.exe	87
PID 4920 wrote to memory of 4720	4920	msedge.exe	87
PID 4920 wrote to memory of 4720	4920	msedge.exe	87
PID 4920 wrote to memory of 4720	4920	msedge.exe	87
PID 4920 wrote to memory of 4720	4920	msedge.exe	87
PID 4920 wrote to memory of 4720	4920	msedge.exe	87
PID 4920 wrote to memory of 4720	4920	msedge.exe	87
PID 4920 wrote to memory of 4720	4920	msedge.exe	87
PID 4920 wrote to memory of 4720	4920	msedge.exe	87
PID 4920 wrote to memory of 4720	4920	msedge.exe	87
PID 4920 wrote to memory of 4720	4920	msedge.exe	87
PID 4920 wrote to memory of 4720	4920	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\914d4dd1aa6138f3a17f34819bbb96bb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff935e46f8,0x7fff935e4708,0x7fff935e4718
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,5639974406840819473,15099556999186322060,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,5639974406840819473,15099556999186322060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,5639974406840819473,15099556999186322060,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5639974406840819473,15099556999186322060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5639974406840819473,15099556999186322060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,5639974406840819473,15099556999186322060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,5639974406840819473,15099556999186322060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5639974406840819473,15099556999186322060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5639974406840819473,15099556999186322060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5639974406840819473,15099556999186322060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5639974406840819473,15099556999186322060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,5639974406840819473,15099556999186322060,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 276B
SHA256 02bd271fbf1d8f8cfeb229ec24d7bfb1c261116853c2e66a3f5d0b3536f59a25
MD5 63e94862b42530f86676ad4d8dad984d
SHA1 3fd2230f79711e641c7d8bc1fc8f6d671319aec8
SHA512 8f57ba1d96f3a97a7867f7eb43efd22baea3a78766fd88e87affcbc1e2e1699de833cbe9d78d22fa784ebf9602bd2006ee315ea13aebbcb79b56ec137c7a5aff
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ee4c26a836753f9424897f77a36e0174e7b60f723cbd8fee01862cf16276ff1b
MD5 7f131ccf5d88a0f253877eaf7fed781a
SHA1 81789ffd72702c0fc8b52a35ad18daffa93f8bf9
SHA512 275641dbf80da72223ba72d2592bdffbf6cb90f8ce648166efc7bede906e43d25b5e2020dd365eab922ad059ef183e271fff7531f63254dbdc29e216b6183b36
SSDEEP 96:nYkM51Zega9IQwpvWMoiVmdeHpCrxbGUWQyV+VD7ziEwb:nYkcDNaCQGWMXpCbGrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 cd42470abc0e74ae8a914b9406d284c1b4758d5f4b56d7a63c25c35c4f2bc5d4
MD5 a314faab4745b0490b61fc8be4d6f451
SHA1 dd316d6e4a9f435912ed9e3fdda896c49fb83158
SHA512 402602e578d361ab07faa86049a2748672a5dc788a56f14861d2497baf097a72b08b7ce9cf5738f287bc8e10cf8d6c30a192bb8329b091d3c3ba45e0c22df120
SSDEEP 96:nYk351ZTga9IQwpvWMoiVmdeEoqqpCrxbGUWQyV+VD7AiEwb:nYkJDMaCQGWMkqpCbGrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3f269c164a2834ee11c5faf8f4086985acdbabede4978487c8636f292c37f27d
MD5 9075836e7cbf91710135b64c4e631d55
SHA1 ea9aeee7842c13e3d4f68f7dbb2f00ac2edb9080
SHA512 3b48bace071c3b51f2cec310111837a5bdc3dcb4b7432cc3fc94597c35eec892ad28b7b23f6abec7d7aee459bfc355f6fe6ee30e9594e1a267fe7b60a012927a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupOkOe2RUfjf7Zy3z2OMDCRh:A9iIxuERzA83h09RZxYOkQCzZyaOMWRh
MD5 SHA1 SHA512 SSDEEP

Submit Download