58735a25246307c5998b40b698b31be8dbb53d841152106b807923f4e376a3e9

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91b0d7bac2b362a26a6e9db6dcf2f023_JaffaCakes118.html
Size 36KB
Sample240603-n2n5eaeg98
SHA256 58735a25246307c5998b40b698b31be8dbb53d841152106b807923f4e376a3e9
MD5 91b0d7bac2b362a26a6e9db6dcf2f023
SHA1 6fa25912fcdd85abaeed6b29ba953fc5b9ed5288
SHA512 977e3df0b939afc7855c0aa4ee0023418d2c0fcc3bd47495ec145497417a16d888b1b931b3feda5bf55fd29b12c7a356488b4980db007a1dcd4c4a8193d705db
SSDEEP 768:zwx/MDTH6M88hARBZPXYE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6T8iX6DJtxo6qLRR:Q/zbJxNVEuxSx/d8/K
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
1072	msedge.exe
1072	msedge.exe
4500	identity_helper.exe
4500	identity_helper.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 4696	1072	msedge.exe	85
PID 1072 wrote to memory of 4696	1072	msedge.exe	85
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 2128	1072	msedge.exe	86
PID 1072 wrote to memory of 4188	1072	msedge.exe	87
PID 1072 wrote to memory of 4188	1072	msedge.exe	87
PID 1072 wrote to memory of 1200	1072	msedge.exe	88
PID 1072 wrote to memory of 1200	1072	msedge.exe	88
PID 1072 wrote to memory of 1200	1072	msedge.exe	88
PID 1072 wrote to memory of 1200	1072	msedge.exe	88
PID 1072 wrote to memory of 1200	1072	msedge.exe	88
PID 1072 wrote to memory of 1200	1072	msedge.exe	88
PID 1072 wrote to memory of 1200	1072	msedge.exe	88
PID 1072 wrote to memory of 1200	1072	msedge.exe	88
PID 1072 wrote to memory of 1200	1072	msedge.exe	88
PID 1072 wrote to memory of 1200	1072	msedge.exe	88
PID 1072 wrote to memory of 1200	1072	msedge.exe	88
PID 1072 wrote to memory of 1200	1072	msedge.exe	88
PID 1072 wrote to memory of 1200	1072	msedge.exe	88
PID 1072 wrote to memory of 1200	1072	msedge.exe	88
PID 1072 wrote to memory of 1200	1072	msedge.exe	88
PID 1072 wrote to memory of 1200	1072	msedge.exe	88
PID 1072 wrote to memory of 1200	1072	msedge.exe	88
PID 1072 wrote to memory of 1200	1072	msedge.exe	88
PID 1072 wrote to memory of 1200	1072	msedge.exe	88
PID 1072 wrote to memory of 1200	1072	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91b0d7bac2b362a26a6e9db6dcf2f023_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6b7d46f8,0x7ffd6b7d4708,0x7ffd6b7d4718
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,10849420468804100229,3238701691974682478,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,10849420468804100229,3238701691974682478,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,10849420468804100229,3238701691974682478,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10849420468804100229,3238701691974682478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10849420468804100229,3238701691974682478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,10849420468804100229,3238701691974682478,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,10849420468804100229,3238701691974682478,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10849420468804100229,3238701691974682478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10849420468804100229,3238701691974682478,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10849420468804100229,3238701691974682478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10849420468804100229,3238701691974682478,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,10849420468804100229,3238701691974682478,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 613B
SHA256 779d406d9ba157841fd1f3430e8889017536876d257790281e4529e0773c040c
MD5 11f731c92c7b9260861ccaa46efa5c5b
SHA1 719f7f491504deac66c69a6733437dc084268bf1
SHA512 143334e6068a2215ce7a6dbeebab0ceeb2a518ab918da5ece8d3e39fa691e937f27fd2fdc7662c7773ad5609c621eb4d1dccca52d73c5986192b479c11a47178
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 9e0cdfc71b7401468630f78114241fc247f1d6c4b74b6d3d19cbbeb7c4b895a0
MD5 3402341c395bcc1d41741dfbdf57286e
SHA1 38329474acb619ab68f1782d5887db61c63c0824
SHA512 dc0ec3880b78668e286519cac82184ccc0bbee1bee6361d2d22400f70f2879bd068b8aaea9f6dcf0265982784e1a7b93f3aedd2185709c4c60975b49b4959c10
SSDEEP 96:nvkfY1Zn2wpvWMoiVmdeHk43yUWQyV+VDCziEwb:nvkAHn2GWMXcro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

eabfdb61-56ea-48b4-9157-7edb85891cf7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eabfdb61-56ea-48b4-9157-7edb85891cf7.tmp
Size 6KB
SHA256 fccfaf0f6c82fcd3e219b8e42a77e060d92f25bae053ed3e97bc848b14c8aec4
MD5 57f593eea3684ffe148edcf286d0bbb4
SHA1 8bd22fe9e551e83a1608ff2d4b7ad34cd201086c
SHA512 20c597061d13858d69cf3e78431bfd9b449c82676c1d2ffc98d07fcad24cc47be00a41c592485d96c368763800315990dc42224169004e46f315346b9fd90e6e
SSDEEP 96:nvkWY1ZX2wpvWMoiVmdeE4E62k43yUWQyV+VD7AiEwb:nvkXHX2GWMnE62crg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 79ccd73fe8f9409b85cd2f5955e66a2202e13a8a3a26e6328b5c43b325c949de
MD5 05540028d113dc22bf1675b25aa853a6
SHA1 642d6302368b5a44d59f05d450c7d9ee86323c43
SHA512 6ee64953e91be02f86e5562e19b5e00a288dcd1d94c0aa3740aaad0da7c186c27f2a47ed8c0b777d835976652126a7eb8e54b5ce89fcbf8768c92a9c303e5b6a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup/cTe2RUgRy4Vp3z2OMDCRY:A9iIxuERzA83h09RZxY0DZ/paOMWRHq7
MD5 SHA1 SHA512 SSDEEP

Submit Download