9f2c093d1d55c9e5111e9d33a7a30a8f98a9e06fc7f8a836cf06ce8ce58384f7

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91a73260f253264594fc37ad226df816_JaffaCakes118.html
Size 20KB
Sample240603-ntvl8aee37
SHA256 9f2c093d1d55c9e5111e9d33a7a30a8f98a9e06fc7f8a836cf06ce8ce58384f7
MD5 91a73260f253264594fc37ad226df816
SHA1 bf6589a2f5e12e75bfe93c07162ec9ed3fb3b722
SHA512 c90b9066d5659b4adc51badff87b9ca0603ff1501dad0ce8f6db60763721e2a6816682e9349165ce00b404b75a4fb462271184379c8fc460add7a16c57bfa30d
SSDEEP 384:dou4NI/169rQUt20/euBx3O7FYPusnzZZZOI4r2vFM/HVd/NMjm2Zi4BV48Ywyrc:0N9g02uBdO7FYPusnznZ02vFM/HVd/NK
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
1684	msedge.exe
1684	msedge.exe
4492	identity_helper.exe
4492	identity_helper.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2924	1684	msedge.exe	82
PID 1684 wrote to memory of 2924	1684	msedge.exe	82
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 2740	1684	msedge.exe	83
PID 1684 wrote to memory of 5084	1684	msedge.exe	84
PID 1684 wrote to memory of 5084	1684	msedge.exe	84
PID 1684 wrote to memory of 976	1684	msedge.exe	85
PID 1684 wrote to memory of 976	1684	msedge.exe	85
PID 1684 wrote to memory of 976	1684	msedge.exe	85
PID 1684 wrote to memory of 976	1684	msedge.exe	85
PID 1684 wrote to memory of 976	1684	msedge.exe	85
PID 1684 wrote to memory of 976	1684	msedge.exe	85
PID 1684 wrote to memory of 976	1684	msedge.exe	85
PID 1684 wrote to memory of 976	1684	msedge.exe	85
PID 1684 wrote to memory of 976	1684	msedge.exe	85
PID 1684 wrote to memory of 976	1684	msedge.exe	85
PID 1684 wrote to memory of 976	1684	msedge.exe	85
PID 1684 wrote to memory of 976	1684	msedge.exe	85
PID 1684 wrote to memory of 976	1684	msedge.exe	85
PID 1684 wrote to memory of 976	1684	msedge.exe	85
PID 1684 wrote to memory of 976	1684	msedge.exe	85
PID 1684 wrote to memory of 976	1684	msedge.exe	85
PID 1684 wrote to memory of 976	1684	msedge.exe	85
PID 1684 wrote to memory of 976	1684	msedge.exe	85
PID 1684 wrote to memory of 976	1684	msedge.exe	85
PID 1684 wrote to memory of 976	1684	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91a73260f253264594fc37ad226df816_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed0d246f8,0x7ffed0d24708,0x7ffed0d24718
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,7064314772961064932,17066469049149798651,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,7064314772961064932,17066469049149798651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,7064314772961064932,17066469049149798651,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7064314772961064932,17066469049149798651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7064314772961064932,17066469049149798651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,7064314772961064932,17066469049149798651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,7064314772961064932,17066469049149798651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7064314772961064932,17066469049149798651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7064314772961064932,17066469049149798651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7064314772961064932,17066469049149798651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7064314772961064932,17066469049149798651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,7064314772961064932,17066469049149798651,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 558B
SHA256 e14d5c8b5bf52986925d35b53d0f569e386497e75e9e87e3735311f5f0d133a4
MD5 618821f367643053ada53279784afed9
SHA1 a5c5e9fe5b92a549c87b21cacbf7b74f2e712362
SHA512 1d18d9f45c79b654a9242ae9f914119cb62dbb62c21fc028c92d71306bba46e5a9e7000d978c08b8456561fdebf1b7a7d1933e409e267f6190c3d54c5d6830b0
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d763dfda9ee1f04da78b8c4360561ffb7c99113ea241a3da78cdd193c1c8c3df
MD5 181c770d115d5b26c4fcacc0aee81f45
SHA1 5b5f26b18e13d09e02190cfa35aac0ad2ad2a05a
SHA512 32bd5d98c4e083c8948946e8a8c9d85d6b620ff8b019e2357ac9bae85b32b02f26d368c101fa0df89fc6adb613509697ba995ae50afcf2672df09025b0b4ab24
SSDEEP 96:nvk3Da1xvega9IQwpvWMoiVmdeHpCrxb7UWQyV+VDCAiEwb:nvkzanvNaCQGWMXp6b7rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 e6d7958368a0f09aeb9b787689e163cb5ba91ee04ae951051c48d27f88b94ae8
MD5 de8e7ec4ae056eb8f1587d29f5a6d7c0
SHA1 b5bed526b067ec3b2fccd8867382328c7f98f83c
SHA512 0024aba4ff13c67ccf8348e1aebd334682fde7d5dc2d807f31e4170fe36b64de8e368d5f961bbb1a87eafc3e5cae31670876937e1dfe79f1013489661b28f608
SSDEEP 96:nvkMDa1xvega9IQwpvWMoiVmdeHpCrxb7UWQyV+VDCziEwb:nvk6anvNaCQGWMXp6b7ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 923d010b0f5dc1d847225faa3a3aec8157a4538a8fb63e0142d6b0245a441223
MD5 df0c33fc8290c4d2fc98916fe6aaa477
SHA1 70bbd07609b45720cbf43867faafc742eb81a505
SHA512 41dee3ecf2795c3e4a22ceff5c8ff8b6cb5ae2dd0529d43a96ba83338dff2472b80689bc2c25a565e8acec6e299800aba6d544272b2dad11d8c2bfcbd57847e6
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRk4e2RUEjf7ZX3z2OMDCRI:A9iIxuERzA83h09RZxYRk2bzZXaOMWRI
MD5 SHA1 SHA512 SSDEEP

Submit Download