515ea8a61e05e468d44887ce6f48f2d141836b36e32b7235d41ab82cdd6776fd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
924ad0edbe2474b152ef9f2663811a1e_JaffaCakes118.html
Size 125KB
Sample240603-s2mc2aba8v
SHA256 515ea8a61e05e468d44887ce6f48f2d141836b36e32b7235d41ab82cdd6776fd
MD5 924ad0edbe2474b152ef9f2663811a1e
SHA1 a7ca853b886e17cd6c7b1334cabd6ae61083d93c
SHA512 272fdc74410bb69cdf0a8382c273b909a1ddef9b2018467454a70215335a82565bf526a6d8f7ff6b61773a735a6593a3fb97d0f49aa4d53ee00ecd0dba14f1bf
SSDEEP 1536:rVozyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:rmzyfkMY+BES09JXAnyrZalI+YQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
5108	msedge.exe
5108	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 4208	5108	msedge.exe	82
PID 5108 wrote to memory of 4208	5108	msedge.exe	82
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 1432	5108	msedge.exe	83
PID 5108 wrote to memory of 4260	5108	msedge.exe	84
PID 5108 wrote to memory of 4260	5108	msedge.exe	84
PID 5108 wrote to memory of 4664	5108	msedge.exe	85
PID 5108 wrote to memory of 4664	5108	msedge.exe	85
PID 5108 wrote to memory of 4664	5108	msedge.exe	85
PID 5108 wrote to memory of 4664	5108	msedge.exe	85
PID 5108 wrote to memory of 4664	5108	msedge.exe	85
PID 5108 wrote to memory of 4664	5108	msedge.exe	85
PID 5108 wrote to memory of 4664	5108	msedge.exe	85
PID 5108 wrote to memory of 4664	5108	msedge.exe	85
PID 5108 wrote to memory of 4664	5108	msedge.exe	85
PID 5108 wrote to memory of 4664	5108	msedge.exe	85
PID 5108 wrote to memory of 4664	5108	msedge.exe	85
PID 5108 wrote to memory of 4664	5108	msedge.exe	85
PID 5108 wrote to memory of 4664	5108	msedge.exe	85
PID 5108 wrote to memory of 4664	5108	msedge.exe	85
PID 5108 wrote to memory of 4664	5108	msedge.exe	85
PID 5108 wrote to memory of 4664	5108	msedge.exe	85
PID 5108 wrote to memory of 4664	5108	msedge.exe	85
PID 5108 wrote to memory of 4664	5108	msedge.exe	85
PID 5108 wrote to memory of 4664	5108	msedge.exe	85
PID 5108 wrote to memory of 4664	5108	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\924ad0edbe2474b152ef9f2663811a1e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa991346f8,0x7ffa99134708,0x7ffa99134718
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,10049256530626897529,2307373074024016331,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,10049256530626897529,2307373074024016331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,10049256530626897529,2307373074024016331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,10049256530626897529,2307373074024016331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,10049256530626897529,2307373074024016331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,10049256530626897529,2307373074024016331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,10049256530626897529,2307373074024016331,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
MD5 c9c4c494f8fba32d95ba2125f00586a3
SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 60967aef6ec1031baa38af96d02f855957fd4b134291d4032c5e2fd6addf51e8
MD5 eab913f53dd2813d3f0e4b47e63cbece
SHA1 b71e0c166b846df481f96eff8cf9a1ced4e57a16
SHA512 7a70274ae0222bb406524267b24d57d24ae97c6dd18ce2a2c9690700f605cb88d63d529c4795efbc9604aaaad61c11ead8d9788353763d67aefee55cd9835c04
SSDEEP 96:nHkMa1YORwpvWMoiVmdeHm0SUWQyV+VDCziEwb:nHkfLRGWMX2ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a7a774790ab4ab00f5a33cd012564215ca3cbafd44963c41f7e5f2a18a570c63
MD5 223c1ab7bde6ce9d2778814f4fb6f320
SHA1 4d83424c8d0f37c9eb831bb9c135c63e0270ba90
SHA512 03236700c3386562352ca76ff3bf11a5eb09a7c997c183b525482249aa80063553c89532d2a7c599a7869435014f507a45356d68cadd1828c14388ea6c6aa077
SSDEEP 96:nHk3a1YORwpvWMoiVmdeHm0SUWQyV+VDCAiEwb:nHkKLRGWMX2rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 5d5d96223a2ba15afeb79aa168672fdb51dd1df04cbd8f0c4b8b55c723437b5f
MD5 9c8a5e8e17a65cafb8e12d1c90cb296b
SHA1 9b40ef58753a9a8adf312831e8d19091c68d23bc
SHA512 2ecab893a4b5013a86ee5a61d76f4656935051d192b28855559e4d01cf8ef6b8f3e4936fdf5594ef37a29a312e9f1a1d5554d0c177a1c626766eef13df7d01e9
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupdvc9e2RUSXzG3z2OMDCRHU:A9iIxuERzA83h09RZxYcjGaOMWRHqlWW
MD5 SHA1 SHA512 SSDEEP

Submit Download