e33bf692f273a3c10eaa1197c6bb46631d106e34f6e48e2e47e5c339ecdb75cf

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9257f04b3101458e7f831c079953c1a5_JaffaCakes118.html
Size 13KB
Sample240603-tb7fysbe31
SHA256 e33bf692f273a3c10eaa1197c6bb46631d106e34f6e48e2e47e5c339ecdb75cf
MD5 9257f04b3101458e7f831c079953c1a5
SHA1 f06bd4df1645f8ab946d5ee7823400cb6abf6514
SHA512 c211b330fe6b267332e34340e31b793925c9c719bf3073c29750be6cfa571bc46233ed9b1a46762706baab5d8bc209883300ec61e7eb17feeb7f939734d0a114
SSDEEP 384:3c6qPVfPXnu40KbrB1+wtOeqxRXEzuEm8VjmFP7R9k:3cXNfP3nexezuwkQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
4992	msedge.exe
4992	msedge.exe
392	identity_helper.exe
392	identity_helper.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 4592	4992	msedge.exe	83
PID 4992 wrote to memory of 4592	4992	msedge.exe	83
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1252	4992	msedge.exe	84
PID 4992 wrote to memory of 1176	4992	msedge.exe	85
PID 4992 wrote to memory of 1176	4992	msedge.exe	85
PID 4992 wrote to memory of 1828	4992	msedge.exe	86
PID 4992 wrote to memory of 1828	4992	msedge.exe	86
PID 4992 wrote to memory of 1828	4992	msedge.exe	86
PID 4992 wrote to memory of 1828	4992	msedge.exe	86
PID 4992 wrote to memory of 1828	4992	msedge.exe	86
PID 4992 wrote to memory of 1828	4992	msedge.exe	86
PID 4992 wrote to memory of 1828	4992	msedge.exe	86
PID 4992 wrote to memory of 1828	4992	msedge.exe	86
PID 4992 wrote to memory of 1828	4992	msedge.exe	86
PID 4992 wrote to memory of 1828	4992	msedge.exe	86
PID 4992 wrote to memory of 1828	4992	msedge.exe	86
PID 4992 wrote to memory of 1828	4992	msedge.exe	86
PID 4992 wrote to memory of 1828	4992	msedge.exe	86
PID 4992 wrote to memory of 1828	4992	msedge.exe	86
PID 4992 wrote to memory of 1828	4992	msedge.exe	86
PID 4992 wrote to memory of 1828	4992	msedge.exe	86
PID 4992 wrote to memory of 1828	4992	msedge.exe	86
PID 4992 wrote to memory of 1828	4992	msedge.exe	86
PID 4992 wrote to memory of 1828	4992	msedge.exe	86
PID 4992 wrote to memory of 1828	4992	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9257f04b3101458e7f831c079953c1a5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff12ef46f8,0x7fff12ef4708,0x7fff12ef4718
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4965556382753626940,11971005880915382066,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,4965556382753626940,11971005880915382066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,4965556382753626940,11971005880915382066,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4965556382753626940,11971005880915382066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4965556382753626940,11971005880915382066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,4965556382753626940,11971005880915382066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,4965556382753626940,11971005880915382066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4965556382753626940,11971005880915382066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4965556382753626940,11971005880915382066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4965556382753626940,11971005880915382066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4965556382753626940,11971005880915382066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4965556382753626940,11971005880915382066,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 308B
SHA256 c9a6aab43e51b4b268f2344bf653cecb52f74582ba3d4922179a485b3b582bd1
MD5 a02fbe605b8074fe2c0d586ebc61b0a1
SHA1 d794af537cb57b6921dc8b1aa0a8986031830ad1
SHA512 0cbc0555a0637d3ef0c9b631ae37ab75ea13b2c3f1b8adbb09b64d3fc19f241023cd547d6a936dc8ffa19c7f2126b7abd4031bfe62b047d143dc01a0ce379852
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c8b2528bf38870d4c20052c1331c8c4f1d3239e349f12cf459a891ba3bc65844
MD5 379e325a81db2f7dfb8c8bf895d9afc8
SHA1 1be5aa806040dd41c60bfc2389a7333d2aab4cee
SHA512 c9c345af70149c95e85fa16643a64a9e8a2c45c418c4534e0662bd44207e4df0b9dbd52b37df6627404ad36c462625aef2d75a516b3617187e3dcb4e12719f2e
SSDEEP 96:nJkf01I1wpvWMoiVmdeHBrz4DOiFUWQyV+VDCziEwb:nJkcC1GWMX2DOiFro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bedb536486eac79b86b8e8c0c9af3e2a66f86afa129649ff0e03b6ada205ec9c
MD5 6e9e5fc7d133a4f14cc7fdfd144cdad8
SHA1 00d61c47794ade05f923939cd1d9b5d681cddb3c
SHA512 7d5daee06ea7fa335de30c0f229f31230e438817e4256b8b152e2febda6d618289cdf05de2d0005089362cf529476dfedb94f59374947dd8d84f17cbd2c47b42
SSDEEP 96:nJkW01IFwpvWMoiVmdeEtqBrz4DOiFUWQyV+VDCAiEwb:nJknCFGWM2q2DOiFrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f327bfbbbd32ddaa990bf64ee9131a971b46842c36e266aa8fe79e333fbe2011
MD5 181655cd14bf1e0bcebc21574faf6551
SHA1 294e3210258c2348d15deef4652d7ae312c3ecd8
SHA512 d4707f2c7dcb854a2702e311f48ad2e6f66d6f77d03108965dfc742cf65001455b0377816c7d558a198664f2423fedad08da94d0d60bdda55f1b134d034b86ba
SSDEEP 96:nJkW01I1wpvWMoiVmdeHBrz4DOiFUWQyV+VDCAiEwb:nJknC1GWMX2DOiFrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7dc29f28518e19525623bac8c317374ee55ba81fd6a6b0fa17c48342a040c683
MD5 9c1d7301885ac2be3176e8753095233b
SHA1 a1496b555e51eba11e66ed196ee3799c75e7c203
SHA512 d3c1aeb94477f329c22f2f426ffe692c03c2abd2d047907e6c2e7d643c8c3d35a9bf5746cbd7e5af3c31b5e99bdd8ed350bcc6cd8af88a28ec4873152048326f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupJHre2RUMMMj2F3z2OMDCRa:A9iIxuERzA83h09RZxYJH7nyFaOMWRH6
MD5 SHA1 SHA512 SSDEEP

Submit Download