50aaf57f73c6928157f7b8a330985b84acb80495062db7937038fc666bd4cfed

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 00:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9329070ef7f20b1d9621bae4f448fc52_JaffaCakes118.html
Size 134KB
Sample240604-azydeafa6y
SHA256 50aaf57f73c6928157f7b8a330985b84acb80495062db7937038fc666bd4cfed
MD5 9329070ef7f20b1d9621bae4f448fc52
SHA1 9db01c6db1d4cb7eba941c26c33bc9f5e0e46758
SHA512 7c7fe17d6dfae8ec4e78f833c83e6d0cf82b69c5ae9871849a82d9fe0547d067f8e6ee9ab05b911843c7786dc5d563ef8dfa2faa60f001ceec502b6441f7e088
SSDEEP 1536:SVbbcMwOyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy+:SVbYMwOyfkMY+BES09JXAnyrZalI+YQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4640	msedge.exe
4640	msedge.exe
2428	identity_helper.exe
2428	identity_helper.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 4776	4640	msedge.exe	81
PID 4640 wrote to memory of 4776	4640	msedge.exe	81
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 3084	4640	msedge.exe	83
PID 4640 wrote to memory of 4436	4640	msedge.exe	84
PID 4640 wrote to memory of 4436	4640	msedge.exe	84
PID 4640 wrote to memory of 5952	4640	msedge.exe	85
PID 4640 wrote to memory of 5952	4640	msedge.exe	85
PID 4640 wrote to memory of 5952	4640	msedge.exe	85
PID 4640 wrote to memory of 5952	4640	msedge.exe	85
PID 4640 wrote to memory of 5952	4640	msedge.exe	85
PID 4640 wrote to memory of 5952	4640	msedge.exe	85
PID 4640 wrote to memory of 5952	4640	msedge.exe	85
PID 4640 wrote to memory of 5952	4640	msedge.exe	85
PID 4640 wrote to memory of 5952	4640	msedge.exe	85
PID 4640 wrote to memory of 5952	4640	msedge.exe	85
PID 4640 wrote to memory of 5952	4640	msedge.exe	85
PID 4640 wrote to memory of 5952	4640	msedge.exe	85
PID 4640 wrote to memory of 5952	4640	msedge.exe	85
PID 4640 wrote to memory of 5952	4640	msedge.exe	85
PID 4640 wrote to memory of 5952	4640	msedge.exe	85
PID 4640 wrote to memory of 5952	4640	msedge.exe	85
PID 4640 wrote to memory of 5952	4640	msedge.exe	85
PID 4640 wrote to memory of 5952	4640	msedge.exe	85
PID 4640 wrote to memory of 5952	4640	msedge.exe	85
PID 4640 wrote to memory of 5952	4640	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9329070ef7f20b1d9621bae4f448fc52_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1ec946f8,0x7ffa1ec94708,0x7ffa1ec94718
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14032350344718539149,3127082712676712699,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,14032350344718539149,3127082712676712699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,14032350344718539149,3127082712676712699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14032350344718539149,3127082712676712699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14032350344718539149,3127082712676712699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14032350344718539149,3127082712676712699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14032350344718539149,3127082712676712699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14032350344718539149,3127082712676712699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14032350344718539149,3127082712676712699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14032350344718539149,3127082712676712699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14032350344718539149,3127082712676712699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14032350344718539149,3127082712676712699,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
MD5 537815e7cc5c694912ac0308147852e4
SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
MD5 8b167567021ccb1a9fdf073fa9112ef0
SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 36e67146b81be08e405b3f341c0c7e32d0e57dd331efa5c4f361c9d56a929099
MD5 b9f3b25fb0e95d43defbf5443073a9f5
SHA1 6f283f051ce85fa8d3cb9c4a41bb4f075eca2815
SHA512 c33a85eca124308e5ee93affbd58d6c24dbb03db8ebbf6bffcfbf1ed414818dd93405a66818211747df6639007f16f09acf75cd73b3a11715187f35c12615268
SSDEEP 96:n7kMS1jD9wpvWMoiVmdeHpRQfpxDUWQyV+VDCziEwb:n7knFD9GWMXpOnDro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c6448907ba65554852c91d2e9f20cb7d01fdb04ce851634aa4e4508bfb3aa013
MD5 9f4b02cefb44618f2aa97c67476c6483
SHA1 36c89764c25b13253e4ba8ecbf47026d3d37db60
SHA512 1c889f8b0227421b7efd7674d10b333d6653af4b3b8d5eeed9d5868817b8b54e23222da19a7bf581ab182a014012d20e0202372344b00d1d2d178be944d73afb
SSDEEP 96:n7k3S1jC9wpvWMoiVmdeHpRQfpxDUWQyV+VD7AiEwb:n7kCFC9GWMXpOnDrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 25ef96779fd33833e0c4aa4953f3ed101cfdb30ad9e669e7f630eda389eccce2
MD5 28c80bf85cd99a0b092dd43252d77deb
SHA1 a1c854603ae4188ed2e8510409cf461d40e31a17
SHA512 2ccf6cda4193f6be425af0965caac24ba7f159f967484484f541d2ecd86b5ac6d699e502b1c262ee052cc698a1d5f048d0de48c02ac5bbc888cca7c38d3f5b1c
SSDEEP 96:n7k3S1jD9wpvWMoiVmdeHpRQfpxDUWQyV+VDCAiEwb:n7kCFD9GWMXpOnDrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 40b60cef8cff77f11216cbed80ad19aeedad9cdbfcefe49f44e702f7d63908e5
MD5 5800dfeb13faf77589f03e01dc491b17
SHA1 d52818143be57ca6562af92b9668d57e870f74ca
SHA512 ee240a41a0c8703132d695a5800bb133c933b06f05317942b385ff3ffa078dd28823d7758c444355c3d462ee8c5966f69df9244e925821c8663be9dbc52d1865
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupTBe2RUPzTys3z2OMDCRHq5:A9iIxuERzA83h09RZxYTVQysaOMWRHq5
MD5 SHA1 SHA512 SSDEEP

Submit Download