9e006ce36503980c7d2335fb84b2198c45ed07dff13274306a5b8778380eae63

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91a889d67d35e00f36e2fb106333c5fe_JaffaCakes118.html
Size 98KB
Sample240603-nwct7adc7x
SHA256 9e006ce36503980c7d2335fb84b2198c45ed07dff13274306a5b8778380eae63
MD5 91a889d67d35e00f36e2fb106333c5fe
SHA1 67b02924920bab7a84f8634d73a150cfb6d988b6
SHA512 4571e5f2cb86ec213f99fb635e057072691f69154d1c377471a29c70bbda5e3eb9350f97946110bbf1ddad0b5d9e22a1034be9646965302b9e4a38bcdb30d75a
SSDEEP 3072:RppgHi+NNWhH0yrFmtzDqEbBRUleNuUlMe9VBdY5PTZ642:cz+uBnNV
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
448	msedge.exe
448	msedge.exe
5960	identity_helper.exe
5960	identity_helper.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 2808	448	msedge.exe	81
PID 448 wrote to memory of 2808	448	msedge.exe	81
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3416	448	msedge.exe	83
PID 448 wrote to memory of 3512	448	msedge.exe	84
PID 448 wrote to memory of 3512	448	msedge.exe	84
PID 448 wrote to memory of 4972	448	msedge.exe	85
PID 448 wrote to memory of 4972	448	msedge.exe	85
PID 448 wrote to memory of 4972	448	msedge.exe	85
PID 448 wrote to memory of 4972	448	msedge.exe	85
PID 448 wrote to memory of 4972	448	msedge.exe	85
PID 448 wrote to memory of 4972	448	msedge.exe	85
PID 448 wrote to memory of 4972	448	msedge.exe	85
PID 448 wrote to memory of 4972	448	msedge.exe	85
PID 448 wrote to memory of 4972	448	msedge.exe	85
PID 448 wrote to memory of 4972	448	msedge.exe	85
PID 448 wrote to memory of 4972	448	msedge.exe	85
PID 448 wrote to memory of 4972	448	msedge.exe	85
PID 448 wrote to memory of 4972	448	msedge.exe	85
PID 448 wrote to memory of 4972	448	msedge.exe	85
PID 448 wrote to memory of 4972	448	msedge.exe	85
PID 448 wrote to memory of 4972	448	msedge.exe	85
PID 448 wrote to memory of 4972	448	msedge.exe	85
PID 448 wrote to memory of 4972	448	msedge.exe	85
PID 448 wrote to memory of 4972	448	msedge.exe	85
PID 448 wrote to memory of 4972	448	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91a889d67d35e00f36e2fb106333c5fe_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae23946f8,0x7ffae2394708,0x7ffae2394718
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7298850912005939328,15399110185887069153,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,7298850912005939328,15399110185887069153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,7298850912005939328,15399110185887069153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7298850912005939328,15399110185887069153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7298850912005939328,15399110185887069153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7298850912005939328,15399110185887069153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7298850912005939328,15399110185887069153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7298850912005939328,15399110185887069153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7298850912005939328,15399110185887069153,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7298850912005939328,15399110185887069153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7298850912005939328,15399110185887069153,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7298850912005939328,15399110185887069153,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 182B
SHA256 31e2bcfc96bc2a345cc324a71a6eafbe2bc0386c1b11316737e67271b605f847
MD5 e8d89bf23b32e41f2b4ce7029484d94c
SHA1 0ea4948e92563fa501faad79999c394950e239fd
SHA512 9f7dd967bf18f19701dd2c967c7010c9e815fc6aa19c636b04758ad7ce06aef925a969429c2bdcf0e8ff4edd328c2bb93e0f5adb215cc9088ecadebfb1d91d7a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 fbc2ef0c48a7a20bfef152689f528db534338bb85b84fbb7cd6699096da58f97
MD5 1d80a6a45f1b4d5b5e2e17098fad7f0e
SHA1 689adaa79886a7a517e7be7bb9777f9368b8aa8f
SHA512 f870d04aa918a42259eb0dc989d40277a935d93db21b9e9a84b4e40d022fb29c6392dbe1bca74de622d810cbd4d6c49c13c1513b017eecd2bf3cdad53b3690f7
SSDEEP 96:nUkOhB1ayv3wpvWMoiVmdeHplwtAacWKUWQyV+VDCziEwb:nUkeBUyvGWMXp9XWKro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 23dd5728dce754f03f3ac2553624cfab65f787a5cba02255a76c1a86df689a0b
MD5 5f518f70c3aeb60adc59d1178fa86fa1
SHA1 30917e075869ff3cf3383bfaba5c7669f887e5f7
SHA512 b18b7806f9b3dc68823328012cd2c9afdfc2c8d351634fbd4fc282e0ef56b8d0a91734773b39d47d5e3ad9eb8c39c6ee13dbbff4fe696dc7b906bd4a0a972725
SSDEEP 96:nUkFhB1ayeOT3wpvWMoiVmdeC2plwtAacWKUWQyV+VDCAiEwb:nUkzBUyprGWMS2p9XWKrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9aa472bffc6ce3e1094d84ba5475a3510d29929ebf314b3031ca67ec71a4a2ce
MD5 2493150a2096c4634f548486e7cbc7e3
SHA1 46173b93eb33e23ceafed45a58c3a67e9d59f766
SHA512 1db92f2c9529c2b9cba2eac237f4f0db591d4ff592f9acb87fe86f869106054291534790dc47a01db7ab76a8160ba7ceacff8be04923618978b7551c3d22cf27
SSDEEP 96:nUkFhB1ayv3wpvWMoiVmdeC2plwtAacWKUWQyV+VDCAiEwb:nUkzBUyvGWMS2p9XWKrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 ddc07a3b8314df9e5a2e486301727b60d8290c583e13eeb5715094cbf7309162
MD5 bdf393fdfc8cfdbda95e50cee19b679b
SHA1 fbb4a52bb952a744be24b1c6aa5fcd9582720172
SHA512 1da17c6c83f74bfb84450bf266c5191c9a0972ffc96eff772855f8ecfabe3745d2f22dce651b89dfb9d2fc3d10a0b2951f1f8e681b4e3d5e08e31c2ed9feacbd
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup2Ne2RULR2ZV3z2OMDCRHqI:A9iIxuERzA83h09RZxYiIYVaOMWRHqlS
MD5 SHA1 SHA512 SSDEEP

Submit Download