41c85159d3759a4a97267dea6972e259f962b9e20fb9c636759aacf07d340559

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b20b2d3805549f70698ff9d46f49252_JaffaCakes118.html
Size 132KB
Sample240610-sn192a1bpf
SHA256 41c85159d3759a4a97267dea6972e259f962b9e20fb9c636759aacf07d340559
MD5 9b20b2d3805549f70698ff9d46f49252
SHA1 384cd2452ad05ea9c071971961b8358e8de6e5d0
SHA512 fa54b5b58feee30dbea30c9978a73b217d9d39ae4d72f02e0faf0641bac4ab5b890ee3076e8cbdc94de7ff7051e7ab7ee8915157acbf8c61b359617a681e6027
SSDEEP 3072:3lyfkMY+BES09JXAnyrZalI+YIiP5Oe26:3QsMYod+X3oI+YD
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
1556	msedge.exe
1556	msedge.exe
1248	identity_helper.exe
1248	identity_helper.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 3064	1556	msedge.exe	81
PID 1556 wrote to memory of 3064	1556	msedge.exe	81
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4960	1556	msedge.exe	82
PID 1556 wrote to memory of 4824	1556	msedge.exe	83
PID 1556 wrote to memory of 4824	1556	msedge.exe	83
PID 1556 wrote to memory of 2360	1556	msedge.exe	84
PID 1556 wrote to memory of 2360	1556	msedge.exe	84
PID 1556 wrote to memory of 2360	1556	msedge.exe	84
PID 1556 wrote to memory of 2360	1556	msedge.exe	84
PID 1556 wrote to memory of 2360	1556	msedge.exe	84
PID 1556 wrote to memory of 2360	1556	msedge.exe	84
PID 1556 wrote to memory of 2360	1556	msedge.exe	84
PID 1556 wrote to memory of 2360	1556	msedge.exe	84
PID 1556 wrote to memory of 2360	1556	msedge.exe	84
PID 1556 wrote to memory of 2360	1556	msedge.exe	84
PID 1556 wrote to memory of 2360	1556	msedge.exe	84
PID 1556 wrote to memory of 2360	1556	msedge.exe	84
PID 1556 wrote to memory of 2360	1556	msedge.exe	84
PID 1556 wrote to memory of 2360	1556	msedge.exe	84
PID 1556 wrote to memory of 2360	1556	msedge.exe	84
PID 1556 wrote to memory of 2360	1556	msedge.exe	84
PID 1556 wrote to memory of 2360	1556	msedge.exe	84
PID 1556 wrote to memory of 2360	1556	msedge.exe	84
PID 1556 wrote to memory of 2360	1556	msedge.exe	84
PID 1556 wrote to memory of 2360	1556	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9b20b2d3805549f70698ff9d46f49252_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc801b46f8,0x7ffc801b4708,0x7ffc801b4718
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,7486086250939228216,7830055182652729349,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,7486086250939228216,7830055182652729349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,7486086250939228216,7830055182652729349,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7486086250939228216,7830055182652729349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7486086250939228216,7830055182652729349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,7486086250939228216,7830055182652729349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,7486086250939228216,7830055182652729349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7486086250939228216,7830055182652729349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7486086250939228216,7830055182652729349,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7486086250939228216,7830055182652729349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7486086250939228216,7830055182652729349,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,7486086250939228216,7830055182652729349,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2640 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 0d66ee9613c7fa65e39638e0ef312747b04c2468deba8c7fe80f9d1c2026b800
MD5 fd468a3a113608d2cf310a3236d28226
SHA1 8abc624e2c5a18f193ae4f179cd51230fe979601
SHA512 fa70c641b4fd88aab2433a65f2172682ec1258de58efcee9fb58d2615c47f09004426ddb1bccb306ca6e943da4e058a65a4ed8058ae497162eb701d3be811960
SSDEEP 96:nyksp13B73wpvWMoiVmdeHplwtKac5UWQyV+VDCziEwb:nykshBjGWMXpvX5ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fc026b3e41fd60024315693e03554716e8cca23903a6d3a5d05c9a8b3005fc33
MD5 c4543e153639fb4a0146af2074d45d97
SHA1 88f8482c91f741e6c69cd7376cdda9ba9a3ccf40
SHA512 d9555cf80559899f30a68357431f69211f6f43ec84625c088f63ab1b6fc2afeb2683ec0d48e63aad7903f3fd2dc2bdff94feeb1fb20d0a80d9ea2875d913e1c4
SSDEEP 96:nykXp13Br3wpvWMoiVmdeHplwtKac5UWQyV+VD7AiEwb:nyk5hBTGWMXpvX5rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 5fa9b534352ead38edee4d9972249a23757362ff6487c724020f9b0dd51d327f
MD5 66c6c38a10b57c70358c0e8035e7a85f
SHA1 14b3c21c45f592765b25bbc0c9c5572ef4b026ca
SHA512 ebd7159feef7b5518a8fdbf956230eb1bdc33a0751d980720044db4ad8997aa9ff84ef88c1318034d13f766046f6575dd84f17bf48df20d3f6491bd5897be8b2
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup+Ne2RUd2ZB3z2OMDCRHqlH:A9iIxuERzA83h09RZxYKZBaOMWRHqlWO
MD5 SHA1 SHA512 SSDEEP

Submit Download