69c7cc37554aa4d9fde395a5c1dedca526024dab1e3bed680b33c91e73617055

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9199ebc81cd14258b04248507983e268_JaffaCakes118.html
Size 34KB
Sample240603-ng33tscf4y
SHA256 69c7cc37554aa4d9fde395a5c1dedca526024dab1e3bed680b33c91e73617055
MD5 9199ebc81cd14258b04248507983e268
SHA1 476deb14f644861ff1982c8acb0046c61b731e57
SHA512 3949b6cfe6cd30d88b4b4c21c3bd8b3eef047e077d9a05ef86a261c694a835684225097d41c2f442321f82742377b911be1a87ec78e06d30e2c150c1267830fd
SSDEEP 768:M7EpFwSXe6eDewe7eIeygjI1aCJC3CNChCICrC/CvCPJExBq0Z24HLx8lFfFn:MwpFwSuDqtClpjI0EWmyP84yiJ4q0Z2N
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
3720	msedge.exe
3720	msedge.exe
4264	identity_helper.exe
4264	identity_helper.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 4476	3720	msedge.exe	82
PID 3720 wrote to memory of 4476	3720	msedge.exe	82
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 5076	3720	msedge.exe	83
PID 3720 wrote to memory of 4816	3720	msedge.exe	84
PID 3720 wrote to memory of 4816	3720	msedge.exe	84
PID 3720 wrote to memory of 4140	3720	msedge.exe	85
PID 3720 wrote to memory of 4140	3720	msedge.exe	85
PID 3720 wrote to memory of 4140	3720	msedge.exe	85
PID 3720 wrote to memory of 4140	3720	msedge.exe	85
PID 3720 wrote to memory of 4140	3720	msedge.exe	85
PID 3720 wrote to memory of 4140	3720	msedge.exe	85
PID 3720 wrote to memory of 4140	3720	msedge.exe	85
PID 3720 wrote to memory of 4140	3720	msedge.exe	85
PID 3720 wrote to memory of 4140	3720	msedge.exe	85
PID 3720 wrote to memory of 4140	3720	msedge.exe	85
PID 3720 wrote to memory of 4140	3720	msedge.exe	85
PID 3720 wrote to memory of 4140	3720	msedge.exe	85
PID 3720 wrote to memory of 4140	3720	msedge.exe	85
PID 3720 wrote to memory of 4140	3720	msedge.exe	85
PID 3720 wrote to memory of 4140	3720	msedge.exe	85
PID 3720 wrote to memory of 4140	3720	msedge.exe	85
PID 3720 wrote to memory of 4140	3720	msedge.exe	85
PID 3720 wrote to memory of 4140	3720	msedge.exe	85
PID 3720 wrote to memory of 4140	3720	msedge.exe	85
PID 3720 wrote to memory of 4140	3720	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9199ebc81cd14258b04248507983e268_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde10f46f8,0x7ffde10f4708,0x7ffde10f4718
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,4436865294513071086,2847899989786012938,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,4436865294513071086,2847899989786012938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,4436865294513071086,2847899989786012938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4436865294513071086,2847899989786012938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4436865294513071086,2847899989786012938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,4436865294513071086,2847899989786012938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,4436865294513071086,2847899989786012938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4436865294513071086,2847899989786012938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4436865294513071086,2847899989786012938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4436865294513071086,2847899989786012938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4436865294513071086,2847899989786012938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,4436865294513071086,2847899989786012938,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
MD5 537815e7cc5c694912ac0308147852e4
SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
MD5 8b167567021ccb1a9fdf073fa9112ef0
SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 308B
SHA256 2b085be59feb94921566ffb11c812e400a52c46cd1ca1f9641c6192814724928
MD5 8d565676a88801660120c7763c76292c
SHA1 efd533f16fb7f67df5e5e9fec8ed9a4c76519bdd
SHA512 09ac80217b785b1dad262b22b152e466eaee1a5313e50d1045114046c14090de48bd15f2a3c0bb5c5d5f54ae8fb507709409ae7e2a02a1515d13a55a21a6ad2f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fb8a86050c45d83286e4d630769191a07c9de0b77c4dbd5a1042488bd8228855
MD5 e7881a3eccb82710340a46e9ece3884e
SHA1 4cb29c4a1b14d68301b9beac0e28c76dbe0ea4ba
SHA512 0482dcb4b0e86af14ed9542d931cba4d387dd8c998f56f2589a5915d4bbb7eab8de6d1823a2ec4f3842abbd7e0fd2651fe1f4d339cf701f128844a48a85b4e31
SSDEEP 96:nKk3L1yDz9wpvWMoiVmdeocIVyqpRylpu+UWQyV+VDCAiEwb:nKkbQDz9GWM4cIsqp+pu+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 0558713a7e57bbfb2f1c1b88bcc1da863923914292532d220bca961dfdaab112
MD5 ffa17f3a572805480465f0c7b284b394
SHA1 46b9daf1a81a75dab6bc76cae28feacb4f693ce4
SHA512 f44eac63d74be0ed6c4729ae6fa02e8b768ab73bb75a2689424d24f1a38f1e7c428e85b02479bd3342ad0618e7983663bc34a97c3a0b2539af0f8ca41191e3b3
SSDEEP 96:nKkML1yDD9wpvWMoiVmdeHpRQlpu+UWQyV+VDCziEwb:nKkmQDD9GWMXpMpu+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1c6fa00679c11a08b3624ece3bb1b2ee7a916f7a8cd113b00066cbb7f5c95703
MD5 c62f10f912b59dff962de932af80c78c
SHA1 cfd2eb1144071ea8a8ac8b22e086027a428b0a05
SHA512 051cc2a6f874d9d12cc253d73831583d73553bcd6ca6f1f51e97262a794abc52d2f28d35d38b8f273b8b27c2644473bab683b9f48cbed77bfcd9da264ca3d656
SSDEEP 96:nKk3L1yDD9wpvWMoiVmdeHpRQlpu+UWQyV+VDCAiEwb:nKkbQDD9GWMXpMpu+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 9d2d0cc825acf564b6ee9659f0d8226c584d1cc9f84aa057c62ebfb282a8daed
MD5 10f63e419fe992f208d6f3c9d6d9b78d
SHA1 32af118755d93b19b6f4f974bb5c5cd34a70e70e
SHA512 cfa5cb96d711fa8eba1da8c92d5dab3b16ffc303a542482efdb7689f2541a2e4a18b2f0814b7e976033e2eb01caf8a2dc79045c84b76c6905e491aa4b561ecb9
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup5cde2RUfqTz3z2OMDCRHqW:A9iIxuERzA83h09RZxY5c5LzaOMWRHqW
MD5 SHA1 SHA512 SSDEEP

Submit Download