315809458dabce0bafc9cb66ef181c365d7cc97bd2bb0d7b06b67850f1506f43

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9262943c8a8eaf36b5e5250f476f407f_JaffaCakes118.html
Size 34KB
Sample240603-tk9yfabh2w
SHA256 315809458dabce0bafc9cb66ef181c365d7cc97bd2bb0d7b06b67850f1506f43
MD5 9262943c8a8eaf36b5e5250f476f407f
SHA1 baaaf11c42de7f4620d7848040295fef44d77ccb
SHA512 eb0de8c0ab2a1ae37a91777cfc564accc19341baa32092a5e41abd655e40d81923bd06d09b7e628cc8509f098c2bfc31acf6cc8047964746a103a0738b80837d
SSDEEP 192:uwLVl3Sywb5nEenQjxn5Q/nnQieeNn0nQOkEntNZnQTbnhnQOgncwqYCcwqYCcwi:ZQ/r7uA5IOutq8xDnLA1zd
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
4476	msedge.exe
4476	msedge.exe
3400	identity_helper.exe
3400	identity_helper.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 2260	4476	msedge.exe	81
PID 4476 wrote to memory of 2260	4476	msedge.exe	81
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 1228	4476	msedge.exe	83
PID 4476 wrote to memory of 3716	4476	msedge.exe	84
PID 4476 wrote to memory of 3716	4476	msedge.exe	84
PID 4476 wrote to memory of 1480	4476	msedge.exe	85
PID 4476 wrote to memory of 1480	4476	msedge.exe	85
PID 4476 wrote to memory of 1480	4476	msedge.exe	85
PID 4476 wrote to memory of 1480	4476	msedge.exe	85
PID 4476 wrote to memory of 1480	4476	msedge.exe	85
PID 4476 wrote to memory of 1480	4476	msedge.exe	85
PID 4476 wrote to memory of 1480	4476	msedge.exe	85
PID 4476 wrote to memory of 1480	4476	msedge.exe	85
PID 4476 wrote to memory of 1480	4476	msedge.exe	85
PID 4476 wrote to memory of 1480	4476	msedge.exe	85
PID 4476 wrote to memory of 1480	4476	msedge.exe	85
PID 4476 wrote to memory of 1480	4476	msedge.exe	85
PID 4476 wrote to memory of 1480	4476	msedge.exe	85
PID 4476 wrote to memory of 1480	4476	msedge.exe	85
PID 4476 wrote to memory of 1480	4476	msedge.exe	85
PID 4476 wrote to memory of 1480	4476	msedge.exe	85
PID 4476 wrote to memory of 1480	4476	msedge.exe	85
PID 4476 wrote to memory of 1480	4476	msedge.exe	85
PID 4476 wrote to memory of 1480	4476	msedge.exe	85
PID 4476 wrote to memory of 1480	4476	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9262943c8a8eaf36b5e5250f476f407f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8b8946f8,0x7ffc8b894708,0x7ffc8b894718
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,8272446819466210786,15589760125865153713,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,8272446819466210786,15589760125865153713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,8272446819466210786,15589760125865153713,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8272446819466210786,15589760125865153713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8272446819466210786,15589760125865153713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,8272446819466210786,15589760125865153713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,8272446819466210786,15589760125865153713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8272446819466210786,15589760125865153713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1500 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8272446819466210786,15589760125865153713,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8272446819466210786,15589760125865153713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8272446819466210786,15589760125865153713,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,8272446819466210786,15589760125865153713,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5112 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 8595ee88dd642062c164b7e5ffac5d2e49fc1cfdc6ae2d94b180a8294c1d9f72
MD5 399976c4dfc8eb7e175dba03c08b746a
SHA1 fb799400e547c8409a767ed53d8d8e3e75b41f6c
SHA512 18220d76dc14d3229776de2a57344cf2a96cce20658fa8ac034bbb06008cbb74c1b64c4b2b4b8b67aab4973b331dae7c79cb12502034115cd15a88f202bc9601
SSDEEP 96:nKkMTQ1Dega9IQwpvWMoiVmdeHpCrHb0UWQyV+VDCziEwb:nKk9hNaCQGWMXp8b0ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3f32f68abcf797851bec1e869b02ad20d64643a279bbf4fc615c306b43df6202
MD5 0484e1e90e3a58284a63d70277dba4ca
SHA1 083676270c65d7449b0b3d6838695cbc59cb08a8
SHA512 8f32557fc100499d40b71bb98359d58e617c466f748c28698e0fddc252b86efb0b19ba4dadf928df07399a36a42e7d3fca8aef44b805bfe2446ff23f8e1345f3
SSDEEP 96:nKk3TQ1Dega9IQwpvWMoiVmdeHpCrHb0UWQyV+VDCAiEwb:nKkUhNaCQGWMXp8b0rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 b97b2fb2cb8965611a019b89f32b220fb7b08d1d6f1566453727de23d2729960
MD5 2fed3affd5a073be2cbd3d6d932c27ea
SHA1 cb8059c7d802ae0a401de4e4763f060703a07449
SHA512 989e0eabbf8fd7601e4cebd7cbb6d5be758365a6ded6befcbcb5a8c665b33a0aca118161278c0d7483cce04f8e0c4e624b160493fac92450b30b9d814bbc3151
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupMkFe2RUSC9jf7Zu3z2OMD9:A9iIxuERzA83h09RZxYMkhDEzZuaOMW+
MD5 SHA1 SHA512 SSDEEP

Submit Download