17ce435d5a6e7341a83631d5e88817a97cd8f5ea6b411598bc965474313601e7

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91a7ccb456401c807dc58242e153bf9b_JaffaCakes118.html
Size 23KB
Sample240603-nvw7faee75
SHA256 17ce435d5a6e7341a83631d5e88817a97cd8f5ea6b411598bc965474313601e7
MD5 91a7ccb456401c807dc58242e153bf9b
SHA1 0fcc7f6ee8b37883ffe4d1450d78ef0154858a6b
SHA512 5bbcf346700def7498fc1ae880655f0d2a7622a95fbcb46699afeaa241cb8e31acf19203614d62ac9ad79b79dc899c2d09446d78e80e987db88b1e6e9b97f5ac
SSDEEP 192:N6sog/db5nanQjLntQ/1nQielnsnQOkrntLYnQTbnOnQManQtWMHnFnQ7XnBnQTP:Ysos5Q/6c
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
1468	msedge.exe
1468	msedge.exe
2092	identity_helper.exe
2092	identity_helper.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 4756	1468	msedge.exe	83
PID 1468 wrote to memory of 4756	1468	msedge.exe	83
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 2968	1468	msedge.exe	84
PID 1468 wrote to memory of 3296	1468	msedge.exe	85
PID 1468 wrote to memory of 3296	1468	msedge.exe	85
PID 1468 wrote to memory of 1860	1468	msedge.exe	86
PID 1468 wrote to memory of 1860	1468	msedge.exe	86
PID 1468 wrote to memory of 1860	1468	msedge.exe	86
PID 1468 wrote to memory of 1860	1468	msedge.exe	86
PID 1468 wrote to memory of 1860	1468	msedge.exe	86
PID 1468 wrote to memory of 1860	1468	msedge.exe	86
PID 1468 wrote to memory of 1860	1468	msedge.exe	86
PID 1468 wrote to memory of 1860	1468	msedge.exe	86
PID 1468 wrote to memory of 1860	1468	msedge.exe	86
PID 1468 wrote to memory of 1860	1468	msedge.exe	86
PID 1468 wrote to memory of 1860	1468	msedge.exe	86
PID 1468 wrote to memory of 1860	1468	msedge.exe	86
PID 1468 wrote to memory of 1860	1468	msedge.exe	86
PID 1468 wrote to memory of 1860	1468	msedge.exe	86
PID 1468 wrote to memory of 1860	1468	msedge.exe	86
PID 1468 wrote to memory of 1860	1468	msedge.exe	86
PID 1468 wrote to memory of 1860	1468	msedge.exe	86
PID 1468 wrote to memory of 1860	1468	msedge.exe	86
PID 1468 wrote to memory of 1860	1468	msedge.exe	86
PID 1468 wrote to memory of 1860	1468	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91a7ccb456401c807dc58242e153bf9b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcce9946f8,0x7ffcce994708,0x7ffcce994718
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16849569776038129643,7082395492550361034,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,16849569776038129643,7082395492550361034,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,16849569776038129643,7082395492550361034,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16849569776038129643,7082395492550361034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16849569776038129643,7082395492550361034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16849569776038129643,7082395492550361034,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16849569776038129643,7082395492550361034,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16849569776038129643,7082395492550361034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16849569776038129643,7082395492550361034,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16849569776038129643,7082395492550361034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16849569776038129643,7082395492550361034,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16849569776038129643,7082395492550361034,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a8d6f31604f73995050aeb3fbfad556666ddc96f6e9e1bfcd2a24c6d5149d645
MD5 ff68cad7252a72537bdb66f33b4abd43
SHA1 3da98d6f054831b5fe9532aedebeddd186f8f6f9
SHA512 c262640ca9b94f703db79c9feae445572c0c4683a0342334ca55fae34c0a70bb237726bed7138f5bb7ee9d5b2de20017a2b384aa8c3394bdc7a20bfd8c62b56f
SSDEEP 96:nYkRN1IEj0wpvWMoiVmdeHmQIIUWQyV+VDCziEwb:nYkvWEj0GWMXbro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b00fd41e5de575e471c443e615afcb21cad4c83b87687d22c8ba4a4f8598f49b
MD5 229195a2f5d0a7b061feacf59518af9c
SHA1 5ea65cc1d3e80b5fa8cae1ff31e29b85d18f121d
SHA512 42efcc29169c0b322902c577e05504df02c1eade12e726885e519b2320544d9e18af9771ad999828914af7a43a20432db6c9f5c04b8ddbfb464093271023e9d1
SSDEEP 96:nYk8N1IEj0wpvWMoiVmdeHmQIIUWQyV+VDCAiEwb:nYksWEj0GWMXbrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e77a19f5f237b70908b2c1d12593d1df7a69f1b280211469d7c8237f597b5ec9
MD5 33f34901e5f74abce50f652a34fd509a
SHA1 b97dc66426a75d730bf8871bde197c46a12612c9
SHA512 c7e3d4dbfc693a7732e4e8a22999459494289a2d59773c89675bad1e70481655aafb5aa611856bada56c447b9e8947b1836b3fd9e39488e30ac46043f1746605
SSDEEP 96:nYk8N1Icj0wpvWMoiVmdeHmQIIUWQyV+VDCAiEwb:nYksWcj0GWMXbrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3ec7d6c7bbb0bf81f11aab5c789a3c0321b6b05461de8a2ae77847b5c147b59f
MD5 c00def268e20467fd0ab60cd8ed750ea
SHA1 d0309de275f62e5618c642b44d6d0905f042a1bf
SHA512 edfbf21f3e9c1c253c24a55af0aa238868be8c532d7f29a6a81c32c171584c4ec9760d2b735134788ba3dc159a0aefc8e84810f4d7a0655ac3d38259425651ef
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZMAZe2RUFIKbNXfYOxhZHv:A9iIxuERzA83h09RZxYZM8CNnxTHqTM/
MD5 SHA1 SHA512 SSDEEP

Submit Download