19f7d2fbc9b7231ec08797f29b3ce47155d4387e2ec859e849959b83a8d08bd6

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91d4023f948a7fb0c93cc1ebfc9f2649_JaffaCakes118.html
Size 22KB
Sample240603-pymmvaeh2v
SHA256 19f7d2fbc9b7231ec08797f29b3ce47155d4387e2ec859e849959b83a8d08bd6
MD5 91d4023f948a7fb0c93cc1ebfc9f2649
SHA1 28aceea703391aa5ff60990d9418c009bc5d28e3
SHA512 e2b23160137621e3109112758de4ec653cf173f027d3a0b08b1c09d551b5dc500d5a86a96475fcd910e815d5bf55a8873ca75c58fe2ec2d863612181c944ef67
SSDEEP 192:uwX2b5nrunQjxn5Q/qnQieJNnVnQOkEntSInQTbnZnQ6v06J4RnQNjMBpqnYnQ7F:UQ/qv06kza
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
4616	msedge.exe
4616	msedge.exe
3848	identity_helper.exe
3848	identity_helper.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4764	4616	msedge.exe	82
PID 4616 wrote to memory of 4764	4616	msedge.exe	82
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 1596	4616	msedge.exe	83
PID 4616 wrote to memory of 3168	4616	msedge.exe	84
PID 4616 wrote to memory of 3168	4616	msedge.exe	84
PID 4616 wrote to memory of 4928	4616	msedge.exe	85
PID 4616 wrote to memory of 4928	4616	msedge.exe	85
PID 4616 wrote to memory of 4928	4616	msedge.exe	85
PID 4616 wrote to memory of 4928	4616	msedge.exe	85
PID 4616 wrote to memory of 4928	4616	msedge.exe	85
PID 4616 wrote to memory of 4928	4616	msedge.exe	85
PID 4616 wrote to memory of 4928	4616	msedge.exe	85
PID 4616 wrote to memory of 4928	4616	msedge.exe	85
PID 4616 wrote to memory of 4928	4616	msedge.exe	85
PID 4616 wrote to memory of 4928	4616	msedge.exe	85
PID 4616 wrote to memory of 4928	4616	msedge.exe	85
PID 4616 wrote to memory of 4928	4616	msedge.exe	85
PID 4616 wrote to memory of 4928	4616	msedge.exe	85
PID 4616 wrote to memory of 4928	4616	msedge.exe	85
PID 4616 wrote to memory of 4928	4616	msedge.exe	85
PID 4616 wrote to memory of 4928	4616	msedge.exe	85
PID 4616 wrote to memory of 4928	4616	msedge.exe	85
PID 4616 wrote to memory of 4928	4616	msedge.exe	85
PID 4616 wrote to memory of 4928	4616	msedge.exe	85
PID 4616 wrote to memory of 4928	4616	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91d4023f948a7fb0c93cc1ebfc9f2649_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe542a46f8,0x7ffe542a4708,0x7ffe542a4718
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6235883900090447852,6731183744628449987,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,6235883900090447852,6731183744628449987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,6235883900090447852,6731183744628449987,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6235883900090447852,6731183744628449987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6235883900090447852,6731183744628449987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6235883900090447852,6731183744628449987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6235883900090447852,6731183744628449987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6235883900090447852,6731183744628449987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6235883900090447852,6731183744628449987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6235883900090447852,6731183744628449987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6235883900090447852,6731183744628449987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1292 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6235883900090447852,6731183744628449987,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6104 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2ccfde2ae6e9671a68379619a7c155e73cf04484a563d1a705de6f179ecd24d5
MD5 64131b79a68f05deccb9247d0114cb29
SHA1 7730c9bb0894a9067ee7a3391950d52f800b0fb6
SHA512 06e40c34256a91245eacbe30f022fa1d3c239dd05801d60830269fbed3628e0fd4abba711154f33128237ce0d53b760aaa85598daa3914fa46e520445564ca0f
SSDEEP 96:nTkf+1Jn2wpvWMoiVmdeHk4bUWQyV+VDCziEwb:nTkmbn2GWMX9ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b09b4cbf75b0120abd43ef147f9d54d2fae8b5e1b2ae48de463fbfeb18006bc1
MD5 26116fa1289536268e52009bd9ab5df8
SHA1 5a932c016e8ba404c85718bffa1c6a81c27a3c0b
SHA512 22d143dc9e48ac5ec6155f10bf5c1375e922e0a78be6a73a75718b6bef088d43672a3f571b2abdd64828eccb6a51808e87a8e742ba5e714ccd3bbad9834b5912
SSDEEP 96:nTkW+1JV2wpvWMoiVmdeHk4bUWQyV+VDCAiEwb:nTkNbV2GWMX9rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8e648c4c4bb7a9f311ec6e5ecc784867df841d9a0ad2b41f324af9f86e97f72b
MD5 c0caa9da24bd106e049bc64ca479576e
SHA1 c27450c4167a70a36120ae694a18ae93c67bc016
SHA512 21fa3a2fc6e527b2304847d5a3bc73b02e8a3c0b9a2db9fbd34ca030c320bcb86b4ddee9067294036be2b070c878dd51a02e566328e0727b7c47c03c726039a0
SSDEEP 96:nTkW+1Jn2wpvWMoiVmdeHk4bUWQyV+VDCAiEwb:nTkNbn2GWMX9rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6c3582df900461e05acf3281223aa10bf7c002f3c30f8d6237a08c7d88d6cf7f
MD5 5449f44b04d24a2ea93a129e7343279c
SHA1 1cd29ebd60fa8296fe5aacba5b9362e55e727801
SHA512 fce2e6a8d1ec760af8f986bf1aeb0139f02eb194546f23609e5277042c93d0a7023740c2d0f465832615b8e0e4c64cc38d6102c22fd94bc608339f25e45988fe
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupXsvke2RU6yRV/3z2OMDCR9:A9iIxuERzA83h09RZxYNi/aOMWRHqlWT
MD5 SHA1 SHA512 SSDEEP

Submit Download