912a12f2469be8fa5e99bc3869fe989c8e3a8897bf1236b8a2c5c92a51a5f586

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 15:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92457087c66d86e825816c95fb1ff7c1_JaffaCakes118.html
Size 10KB
Sample240603-sw9ldaca77
SHA256 912a12f2469be8fa5e99bc3869fe989c8e3a8897bf1236b8a2c5c92a51a5f586
MD5 92457087c66d86e825816c95fb1ff7c1
SHA1 1bfda84352ad524ea24acf49ad8411cca6168529
SHA512 2f01cb02f0f27daf095c67557ae1cf8cdc9d2b15e818f56a416ffce5e67b420b1cccd4596070c7bd98fba7e53020fe1f0f12bec8208cf185584d1a1c0f18600d
SSDEEP 192:/6I7ApEdFcu1alQZwEmP6BL+eLZG7YEdx2H24iJyv:L7sEdau1WQZwEfBL+eLZG732H24t
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3800	msedge.exe
3800	msedge.exe
2832	identity_helper.exe
2832	identity_helper.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 1324	3800	msedge.exe	84
PID 3800 wrote to memory of 1324	3800	msedge.exe	84
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 5048	3800	msedge.exe	85
PID 3800 wrote to memory of 3252	3800	msedge.exe	86
PID 3800 wrote to memory of 3252	3800	msedge.exe	86
PID 3800 wrote to memory of 3372	3800	msedge.exe	87
PID 3800 wrote to memory of 3372	3800	msedge.exe	87
PID 3800 wrote to memory of 3372	3800	msedge.exe	87
PID 3800 wrote to memory of 3372	3800	msedge.exe	87
PID 3800 wrote to memory of 3372	3800	msedge.exe	87
PID 3800 wrote to memory of 3372	3800	msedge.exe	87
PID 3800 wrote to memory of 3372	3800	msedge.exe	87
PID 3800 wrote to memory of 3372	3800	msedge.exe	87
PID 3800 wrote to memory of 3372	3800	msedge.exe	87
PID 3800 wrote to memory of 3372	3800	msedge.exe	87
PID 3800 wrote to memory of 3372	3800	msedge.exe	87
PID 3800 wrote to memory of 3372	3800	msedge.exe	87
PID 3800 wrote to memory of 3372	3800	msedge.exe	87
PID 3800 wrote to memory of 3372	3800	msedge.exe	87
PID 3800 wrote to memory of 3372	3800	msedge.exe	87
PID 3800 wrote to memory of 3372	3800	msedge.exe	87
PID 3800 wrote to memory of 3372	3800	msedge.exe	87
PID 3800 wrote to memory of 3372	3800	msedge.exe	87
PID 3800 wrote to memory of 3372	3800	msedge.exe	87
PID 3800 wrote to memory of 3372	3800	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\92457087c66d86e825816c95fb1ff7c1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa597346f8,0x7ffa59734708,0x7ffa59734718
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,5050511469173128755,9235548577139999022,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,5050511469173128755,9235548577139999022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,5050511469173128755,9235548577139999022,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,5050511469173128755,9235548577139999022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,5050511469173128755,9235548577139999022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,5050511469173128755,9235548577139999022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,5050511469173128755,9235548577139999022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,5050511469173128755,9235548577139999022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,5050511469173128755,9235548577139999022,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,5050511469173128755,9235548577139999022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,5050511469173128755,9235548577139999022,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,5050511469173128755,9235548577139999022,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3416 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 fe705e813d25d6d22beffe674c7700dcf5a5332f890725d39827ffc49396088e
MD5 386fcb49b6f377b34ada396942b76ff6
SHA1 69e671b67056febcc61580a654df3c397432e034
SHA512 b732922e258e54813f562927d3461de0089d85e2df794ebcbe97a9ea46215af157ea0dcc710c72f6a2eb1085e1115d60b7ab74e72d8be99e17d6780b5a5c275f
SSDEEP 96:nQkox1d1n3wpvWMoiVmdeHplwtooacB8+UWQyV+VDCziEwb:nQk8b13GWMXpxoXm+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3aa8f44144b86436f3bff91edf2f8504937aa1c794e2346b235dc3eed7040b0b
MD5 4caa09e035a7c90cd2b6791f020aefa3
SHA1 321e374efcd125d534e261c4ffc993674b2ebeaa
SHA512 fb3d1fba16fa6ccdfb67ca7d41f733b9c20e7c6e788573c3058e9f381fea9d471b9f012eda8e88febaef704fbdd4f99a5bd78d01bd81b96937d5bac2c44adaa8
SSDEEP 96:nQkDx1d1n3wpvWMoiVmdeHplwtooacB8+UWQyV+VDCAiEwb:nQk9b13GWMXpxoXm+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 e796f13f1c71527dda2d9c0a3e84c08314b664ae8f6d6d270e83b895feb28275
MD5 124409890e1b871cf0a28e6da64a4132
SHA1 d18163c2d59ea7f5093183cddb341f24636cda3f
SHA512 103fcdf0c8b339ee1b57a85a7a961ee5eccf188455a3ed5d26634a798d3c580909862c3fb26b5bfd7e144d65ea23fae655c05076a715a9d06f493d11c0e66fc0
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupVM9e2RUu/2Z63z2OMDCRHm:A9iIxuERzA83h09RZxYujG6aOMWRHql1
MD5 SHA1 SHA512 SSDEEP

Submit Download