cdee7726deaff195cd3086513fa9cdac10e335bf215d7d4fb5603aece7f07b82

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 14:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
922c4fa0863cf8812017ac363154e7ba_JaffaCakes118.html
Size 35KB
Sample240603-r8jp2sbc77
SHA256 cdee7726deaff195cd3086513fa9cdac10e335bf215d7d4fb5603aece7f07b82
MD5 922c4fa0863cf8812017ac363154e7ba
SHA1 3df0fa610033440b3d56e3d4a3e7e5fb9fa31203
SHA512 0a810ff5f6fa1abfba2e6b5af357f26f879e8d041ded2be708682537de90cf1bbbbe431b51819768bd8ace2920711d2f9b23b4c2a6fa63a42abb1b7bbb29732f
SSDEEP 768:zwx/MDTHuw88hARVZPXwE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6T0ZOh6sggh6lLRb:Q/XbJxNVBu0SZ/N8eK
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
1440	msedge.exe
1440	msedge.exe
2020	identity_helper.exe
2020	identity_helper.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 4004	1440	msedge.exe	82
PID 1440 wrote to memory of 4004	1440	msedge.exe	82
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 4484	1440	msedge.exe	83
PID 1440 wrote to memory of 2336	1440	msedge.exe	84
PID 1440 wrote to memory of 2336	1440	msedge.exe	84
PID 1440 wrote to memory of 4868	1440	msedge.exe	85
PID 1440 wrote to memory of 4868	1440	msedge.exe	85
PID 1440 wrote to memory of 4868	1440	msedge.exe	85
PID 1440 wrote to memory of 4868	1440	msedge.exe	85
PID 1440 wrote to memory of 4868	1440	msedge.exe	85
PID 1440 wrote to memory of 4868	1440	msedge.exe	85
PID 1440 wrote to memory of 4868	1440	msedge.exe	85
PID 1440 wrote to memory of 4868	1440	msedge.exe	85
PID 1440 wrote to memory of 4868	1440	msedge.exe	85
PID 1440 wrote to memory of 4868	1440	msedge.exe	85
PID 1440 wrote to memory of 4868	1440	msedge.exe	85
PID 1440 wrote to memory of 4868	1440	msedge.exe	85
PID 1440 wrote to memory of 4868	1440	msedge.exe	85
PID 1440 wrote to memory of 4868	1440	msedge.exe	85
PID 1440 wrote to memory of 4868	1440	msedge.exe	85
PID 1440 wrote to memory of 4868	1440	msedge.exe	85
PID 1440 wrote to memory of 4868	1440	msedge.exe	85
PID 1440 wrote to memory of 4868	1440	msedge.exe	85
PID 1440 wrote to memory of 4868	1440	msedge.exe	85
PID 1440 wrote to memory of 4868	1440	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\922c4fa0863cf8812017ac363154e7ba_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6fe746f8,0x7ffd6fe74708,0x7ffd6fe74718
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10463878514223759555,5961368947898778083,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,10463878514223759555,5961368947898778083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,10463878514223759555,5961368947898778083,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10463878514223759555,5961368947898778083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10463878514223759555,5961368947898778083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,10463878514223759555,5961368947898778083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,10463878514223759555,5961368947898778083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10463878514223759555,5961368947898778083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10463878514223759555,5961368947898778083,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10463878514223759555,5961368947898778083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10463878514223759555,5961368947898778083,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10463878514223759555,5961368947898778083,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4656 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 613B
SHA256 ce40c789fd1e39ff10f169a018b71e43992de41ba1b0b9852905b97c53bcf5ee
MD5 dd417b1c397c4d3725913df0e5f82a38
SHA1 5ba8d6ead49e23fd05cff95e0864f43e7318e8ae
SHA512 62c2fda78a9819b263057a79127a27fbe60a3076950e85f5e8cae74bc2451e4588c3bb10ae64cbbc4990fb24c2eeb40ce766bcd83012df333067b0a33715e339
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 34f11fe32819ef64b4f7300aed55295b2e49c29a1535579d80d4ad87a60f5a80
MD5 4ad4ad51c65288218d9cb6397bc84503
SHA1 9d71d454cd6ed27033abc5c8b6d92e1650887f95
SHA512 c2b6b1bfdcb9b9406b32499d923216f4681f65ad01e23b46b29bcb58d1c9f0d221a7f5c755b555544ac73b01f8b4098e1783c69f6a5e9ef0c4ebcea331e5d9b2
SSDEEP 96:nrkOm12v3wpvWMoiVmdeHplwtwaco+UWQyV+VDCziEwb:nrkJEvGWMXphXo+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9c2c52152de65c728f2d1b18e535130f323315f45a8d063f31382c94d69e98ff
MD5 1670b259574cf526d06d45d946b6b9f7
SHA1 152f66d11f358ae93f012e239d88b91dcb10b2f9
SHA512 1ebeac87571d31ab0f67d61f52c352f65df4695cf027ff14ee2ebd230bdfc7b517b2925da83dc0b28db0eb04fd2640369a090a293f02cb7693565ba51c5e7da3
SSDEEP 96:nrkFm1233wpvWMoiVmdeESQ82plwtwaco+UWQyV+VD7AiEwb:nrkQEHGWM9Q82phXo+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

acbe2941-aeb1-4418-ad37-19ca88d3b8d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\acbe2941-aeb1-4418-ad37-19ca88d3b8d9.tmp
Size 10KB
SHA256 d9b00b2df40a3498e6aa5fdcd8f7760c32ee5ccdc146652959f55a85af643f78
MD5 b91ac8bc36d0370031b4bd05d0968d5a
SHA1 6c865524a78e4be795a671c1f6747a42491ee5c4
SHA512 8b54fd99ef03c0571139853171169786d2f2b2362bbac18e8b0f6c45f1515d677b59d1bc1cb9e394ff886707a5661f06749bafdff2b1621a9709567d63512798
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup5sde2RUSN2ZH3z2OMDCRHY:A9iIxuERzA83h09RZxY65VkHaOMWRHqh
MD5 SHA1 SHA512 SSDEEP

Submit Download