16467dd4fbc8aa77d2598dc3da9451dd957961ebc71670175b79c3ee9f790a6e

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91add6201188496f86b3c001129da849_JaffaCakes118.html
Size 400KB
Sample240603-nzzs5ade2s
SHA256 16467dd4fbc8aa77d2598dc3da9451dd957961ebc71670175b79c3ee9f790a6e
MD5 91add6201188496f86b3c001129da849
SHA1 ed356b900a5db3b5549f02e74af4493425c994d5
SHA512 5cfefc86bd4cdedf9bf27cf44f6b7ab1425176fe4eaca1f8d9ced3a135576ee9b0fd1c82f42771ece8adeba05937648e864ecca20967069dcdc1c38e3630c3f6
SSDEEP 6144:UEAnn6SxmrfWNUiv2rZtRk/CyFbJHf+aAd:9A6D0UiaZ8/CyFbJ/W
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
1696	msedge.exe
1696	msedge.exe
3920	identity_helper.exe
3920	identity_helper.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 4320	1696	msedge.exe	82
PID 1696 wrote to memory of 4320	1696	msedge.exe	82
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 436	1696	msedge.exe	83
PID 1696 wrote to memory of 4780	1696	msedge.exe	84
PID 1696 wrote to memory of 4780	1696	msedge.exe	84
PID 1696 wrote to memory of 668	1696	msedge.exe	85
PID 1696 wrote to memory of 668	1696	msedge.exe	85
PID 1696 wrote to memory of 668	1696	msedge.exe	85
PID 1696 wrote to memory of 668	1696	msedge.exe	85
PID 1696 wrote to memory of 668	1696	msedge.exe	85
PID 1696 wrote to memory of 668	1696	msedge.exe	85
PID 1696 wrote to memory of 668	1696	msedge.exe	85
PID 1696 wrote to memory of 668	1696	msedge.exe	85
PID 1696 wrote to memory of 668	1696	msedge.exe	85
PID 1696 wrote to memory of 668	1696	msedge.exe	85
PID 1696 wrote to memory of 668	1696	msedge.exe	85
PID 1696 wrote to memory of 668	1696	msedge.exe	85
PID 1696 wrote to memory of 668	1696	msedge.exe	85
PID 1696 wrote to memory of 668	1696	msedge.exe	85
PID 1696 wrote to memory of 668	1696	msedge.exe	85
PID 1696 wrote to memory of 668	1696	msedge.exe	85
PID 1696 wrote to memory of 668	1696	msedge.exe	85
PID 1696 wrote to memory of 668	1696	msedge.exe	85
PID 1696 wrote to memory of 668	1696	msedge.exe	85
PID 1696 wrote to memory of 668	1696	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91add6201188496f86b3c001129da849_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8c3c46f8,0x7fff8c3c4708,0x7fff8c3c4718
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14849363588414674604,10592390035784475726,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,14849363588414674604,10592390035784475726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,14849363588414674604,10592390035784475726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14849363588414674604,10592390035784475726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14849363588414674604,10592390035784475726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14849363588414674604,10592390035784475726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14849363588414674604,10592390035784475726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14849363588414674604,10592390035784475726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14849363588414674604,10592390035784475726,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14849363588414674604,10592390035784475726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14849363588414674604,10592390035784475726,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14849363588414674604,10592390035784475726,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7baa9f40-da86-4a79-8597-3f675bb098de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7baa9f40-da86-4a79-8597-3f675bb098de.tmp
Size 11KB
SHA256 7cc9a1d5494e9d16171428303f470215b9d3b14f15f0e7633c1e368f72d09ef6
MD5 aa08f40ef620ff70b7f26804130c0761
SHA1 b37cf5969a6d2d95feaa7b3df31a36217efed40a
SHA512 e69ed6a6f29c419029911b22839be78a1da579b2d5a7dfdc0f8139cf5c8c5b4ae0977bc3c9fff425bfa1e6beb55ad887dad7b64a284cf75afb327edc77c1f7bc
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupjHde2RUgk3/Mj2g3z2OMDo:A9iIxuERzA83h09RZxYjH5AEygaOMWRj
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 308B
SHA256 05c841713441a0fa687ff358a54d71a1fd37f80409172d2c31e3678869b400cf
MD5 9cf9a60876c04cc85c21f0be18c1d3f7
SHA1 7434995a899ae80ef474bfd7e2eb40a3cafcbf14
SHA512 b6b81012095ed490e988af1f07493fc53b753d76aae4c242d5471787959ffaee37504dd33b1ed213b1bf9fc3966783e8b3d7d5188f15a85d3f47a8e36186074b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 714cb4d75f2834ca9f63ee9e98607d3402322ac51f0b5fa0bfb3662e012a68c0
MD5 e823f26cb90531998b87ad24ad89052e
SHA1 56e97be3b3298945d88bcaf805bc3dce857ea50b
SHA512 4483ce25e9d9101fc1fbfee62d7bb06eb3bc58437b4b961e94dd23fe90f474905324c509676da692d483f3eba892c16ee36c757f0400e6873eca166c579c869f
SSDEEP 96:nGkRJ1pdBwpvWMoiVmdeHBrzvofwUWQyV+VDCziEwb:nGkHHdBGWMXNofwro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2661e526d9bd0359808b13cc7657a67d02e6dbbd5d58c92b4fc1c3abe0ebbca0
MD5 30cdf14f126bc93d76c46fe1c9d591f3
SHA1 9aeceb1251ef1fc0d9f8140ffd17d21ab4efd027
SHA512 721befa457b99267c60b8f3b547c5124a9ca6f47b24aafb334fcb6a38a67f3eebc46d78d2c45e51d551af95842e38f1b14445e51c267b230a4b26064d5148041
SSDEEP 96:nGk8J1pdjwpvWMoiVmdeHBrzvofwUWQyV+VDCAiEwb:nGkkHdjGWMXNofwrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ba9cf1939e333e2b0db4169b4c6ad9236f0a302ba22272f2e7a59e16bacbbec1
MD5 1a21aeddcb753ad24fea9e5af8a3ba8f
SHA1 95bad9cc6f2553ed74415c0e963f73f038ee2560
SHA512 e4f925903ce7e245798e8b46fb2503c95448816ea9d5e65dec405f24f4be776e8416c43d342243381832a4026c0e613ccbaa506d55723ee5780c8f9ae6253b83
SSDEEP 96:nGk8J1pdBwpvWMoiVmdeHBrzvofwUWQyV+VDCAiEwb:nGkkHdBGWMXNofwrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download