d1adf3e88541788814b3eeece2697e7a47a8836e001e06eff5027567dad72ee1

Analysis

max time kernel
145s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
914e37e92958f5f4de8035811edbaf70_JaffaCakes118.html
Size 14KB
Sample240603-llyykabe88
SHA256 d1adf3e88541788814b3eeece2697e7a47a8836e001e06eff5027567dad72ee1
MD5 914e37e92958f5f4de8035811edbaf70
SHA1 bb1f5bf5d309b57d4f21b7fe9ac4df17d94976fa
SHA512 c0a18f00ecd174b8597c87b5e39540e4313a48791257f8899f85b89ca3aa8d128ec689987cd8bce3d1738ae2122ce31d03743ef1640bdfe6a9a462b1dcaaf6de
SSDEEP 192:70RNzDyQW6MmOL+6Vru6WYmxjl8tbFBEh82FbQDEQ8VED9/mhYpW4762YKDaKXY:70RNzDywMmosncDvDR4k61
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
5104	msedge.exe
5104	msedge.exe
4524	identity_helper.exe
4524	identity_helper.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 5036	5104	msedge.exe	83
PID 5104 wrote to memory of 5036	5104	msedge.exe	83
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4008	5104	msedge.exe	84
PID 5104 wrote to memory of 4112	5104	msedge.exe	85
PID 5104 wrote to memory of 4112	5104	msedge.exe	85
PID 5104 wrote to memory of 1668	5104	msedge.exe	86
PID 5104 wrote to memory of 1668	5104	msedge.exe	86
PID 5104 wrote to memory of 1668	5104	msedge.exe	86
PID 5104 wrote to memory of 1668	5104	msedge.exe	86
PID 5104 wrote to memory of 1668	5104	msedge.exe	86
PID 5104 wrote to memory of 1668	5104	msedge.exe	86
PID 5104 wrote to memory of 1668	5104	msedge.exe	86
PID 5104 wrote to memory of 1668	5104	msedge.exe	86
PID 5104 wrote to memory of 1668	5104	msedge.exe	86
PID 5104 wrote to memory of 1668	5104	msedge.exe	86
PID 5104 wrote to memory of 1668	5104	msedge.exe	86
PID 5104 wrote to memory of 1668	5104	msedge.exe	86
PID 5104 wrote to memory of 1668	5104	msedge.exe	86
PID 5104 wrote to memory of 1668	5104	msedge.exe	86
PID 5104 wrote to memory of 1668	5104	msedge.exe	86
PID 5104 wrote to memory of 1668	5104	msedge.exe	86
PID 5104 wrote to memory of 1668	5104	msedge.exe	86
PID 5104 wrote to memory of 1668	5104	msedge.exe	86
PID 5104 wrote to memory of 1668	5104	msedge.exe	86
PID 5104 wrote to memory of 1668	5104	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\914e37e92958f5f4de8035811edbaf70_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbd8946f8,0x7ffdbd894708,0x7ffdbd894718
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6301084780264047582,1063277718840205811,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6301084780264047582,1063277718840205811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,6301084780264047582,1063277718840205811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6301084780264047582,1063277718840205811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6301084780264047582,1063277718840205811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6301084780264047582,1063277718840205811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6301084780264047582,1063277718840205811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6301084780264047582,1063277718840205811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6301084780264047582,1063277718840205811,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6301084780264047582,1063277718840205811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6301084780264047582,1063277718840205811,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6301084780264047582,1063277718840205811,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 d6ea26541cfc73c5a0b1319e311b5162167f0fa65eb6e727c376e4715d953551
MD5 2182b71cde3c3871fa890b7c6319e48e
SHA1 ff33ee68791f5c7478400c2aabfc813696e9029a
SHA512 b1154504ea82bef11a357ce9a98b2aeb3116065226b35e216ae38f4bcbc3d90c8178f3fb38771f47a426b699acfc3af7d38ad41b078e4b42386f226696c02030
SSDEEP 96:nBkfJ1zgjuwpvWMoiVmdeHvSSX+UWQyV+VDCziEwb:nBkRxgjuGWMXJ+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 da33826f0bcfd1e54d04d6908cc88547ec472b6ba85049fee7c6acb1b053b3c2
MD5 bcefa5fef5de9bbe76fe2289ec2b56d0
SHA1 e88c22637edcf1e1a5bd0de3a8108976ed77fea4
SHA512 e15f11da5f15b4a701909a8600b619eb5c4e07757c90bbd47e1454f23034f3be9973f0bad95a01942b74090e3809e231831cce344d14944abc41351a8d33c011
SSDEEP 96:nBkWJ1zwjuwpvWMoiVmdeHvSSX+UWQyV+VD7AiEwb:nBkWxwjuGWMXJ+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a3923a7df519c418168e9c76e3434bf469e1d0a36fbefce36cb27f0a7b190c21
MD5 6c6b20ce1deef7f32fe906ff3f89c4e4
SHA1 437d35f7dc84705ac8455ae59611b1e42a057f7d
SHA512 8fd0a7d0bff13618cc01002508fc383c25ba9c7f67d5a5cd8a9fac95e2665790691dfe6cbc514bf2fe3dc8ccdf4de53e0467e9c96989b014f376476dfadb005d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupMfe2RUd4uK3z2OMDCRHqlL:A9iIxuERzA83h09RZxYMnQKaOMWRHqlL
MD5 SHA1 SHA512 SSDEEP

Submit Download