738be4148db678c7653dc4f1574664c77a41996f11e3b2f25fe3f258c9fd6e9d

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9154d6928b3bc9adf6dab563a1c63b8c_JaffaCakes118.html
Size 19KB
Sample240603-lsrg3aae4t
SHA256 738be4148db678c7653dc4f1574664c77a41996f11e3b2f25fe3f258c9fd6e9d
MD5 9154d6928b3bc9adf6dab563a1c63b8c
SHA1 2edbecc991f89e6ab9c0f25ff07363b4d05ea256
SHA512 ab5c9ec43e0649bec01637a0225cd8ea866a296ea67e92be83c3fad13349217fb0b113a198b5f1b5ba97eaab6d636a9b3c10f76b04f52d54fa332aeca30ec515
SSDEEP 384:HqfL4SXC4rdKA9u+az2tx5Vk2/THJyLqnYPy:kXC4rdKWu+u2tx5Vx/dyOYPy
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2524	msedge.exe
2524	msedge.exe
3652	msedge.exe
3652	msedge.exe
856	identity_helper.exe
856	identity_helper.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 4852	3652	msedge.exe	81
PID 3652 wrote to memory of 4852	3652	msedge.exe	81
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 4688	3652	msedge.exe	82
PID 3652 wrote to memory of 2524	3652	msedge.exe	83
PID 3652 wrote to memory of 2524	3652	msedge.exe	83
PID 3652 wrote to memory of 3404	3652	msedge.exe	84
PID 3652 wrote to memory of 3404	3652	msedge.exe	84
PID 3652 wrote to memory of 3404	3652	msedge.exe	84
PID 3652 wrote to memory of 3404	3652	msedge.exe	84
PID 3652 wrote to memory of 3404	3652	msedge.exe	84
PID 3652 wrote to memory of 3404	3652	msedge.exe	84
PID 3652 wrote to memory of 3404	3652	msedge.exe	84
PID 3652 wrote to memory of 3404	3652	msedge.exe	84
PID 3652 wrote to memory of 3404	3652	msedge.exe	84
PID 3652 wrote to memory of 3404	3652	msedge.exe	84
PID 3652 wrote to memory of 3404	3652	msedge.exe	84
PID 3652 wrote to memory of 3404	3652	msedge.exe	84
PID 3652 wrote to memory of 3404	3652	msedge.exe	84
PID 3652 wrote to memory of 3404	3652	msedge.exe	84
PID 3652 wrote to memory of 3404	3652	msedge.exe	84
PID 3652 wrote to memory of 3404	3652	msedge.exe	84
PID 3652 wrote to memory of 3404	3652	msedge.exe	84
PID 3652 wrote to memory of 3404	3652	msedge.exe	84
PID 3652 wrote to memory of 3404	3652	msedge.exe	84
PID 3652 wrote to memory of 3404	3652	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9154d6928b3bc9adf6dab563a1c63b8c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1ec946f8,0x7ffa1ec94708,0x7ffa1ec94718
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,10094100143297561426,7134987273030008728,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,10094100143297561426,7134987273030008728,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,10094100143297561426,7134987273030008728,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10094100143297561426,7134987273030008728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10094100143297561426,7134987273030008728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,10094100143297561426,7134987273030008728,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,10094100143297561426,7134987273030008728,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10094100143297561426,7134987273030008728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10094100143297561426,7134987273030008728,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10094100143297561426,7134987273030008728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10094100143297561426,7134987273030008728,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,10094100143297561426,7134987273030008728,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5804 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
MD5 537815e7cc5c694912ac0308147852e4
SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
MD5 8b167567021ccb1a9fdf073fa9112ef0
SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 8436795696e9b70d13526feed199bdc2d35deaa180dfa2f343f649dd35f37002
MD5 9a52026b7c3cb2eea6539e29c1b07a46
SHA1 ddca960f7f17a85dcbb0064befd92f1f238b2d00
SHA512 a97a9b97a596b7cd117d73d6f8a65d77a1a826fbd0df7375ede89cc64514724ff65019f6aab691cbf152bed40bdd5e4132734d446ab3e590943ce61d5b5225d2
SSDEEP 96:n72kM/10nD9wpvWMoiVmdeHpRQZpXUWQyV+VDCziEwb:n72kWenD9GWMXp0tro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8c924eb65a8eed81dab16f90f8ce7310e79f8426cc0f60ee260fb88f5ab2ab05
MD5 25f4af73089c78d786a5579cc481749f
SHA1 c0ab2d57021284857fe7d09c1093f398705598aa
SHA512 69a55451c92d22c5f0d08a77b291fe9f7a65291ee5f68df36186b732e769886861b6904891a25698edaa63a89dfcc2f9fe9bd1e56a6ab0d49650a935cdcb991f
SSDEEP 96:n72k3/10nD9wpvWMoiVmdeHpRQZpXUWQyV+VD7AiEwb:n72kvenD9GWMXp0trg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 5825632d1808805f60a0f791c7c1cedbe6dc854199f81cdf6231902a1c4acf15
MD5 d7ca5dcbfabf9ea9a06c21a83e4ac9b3
SHA1 aac57588baea818cec290b118bc9d04ffd61e173
SHA512 af9c313810c46b0bb6382e6dbae90182e924198202a07475991c290c06794af7867797b9debf424735e9ce284d769ae54d5ccfd4a3e0dc803dc1ecce96c71375
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupKAe2RU1qTd3z2OMDCRHqln:A9iIxuERzA83h09RZxYKe1daOMWRHqln
MD5 SHA1 SHA512 SSDEEP

Submit Download