2ff63ce7d6c154e13899100aac7e8a0dce768f83b5dc4b71233fb285f172ccd3

Analysis

max time kernel
145s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9cdc3ab1ec0498cd16b1ce5d8573efe2_JaffaCakes118.html
Size 531KB
Sample240611-d2776ssepd
SHA256 2ff63ce7d6c154e13899100aac7e8a0dce768f83b5dc4b71233fb285f172ccd3
MD5 9cdc3ab1ec0498cd16b1ce5d8573efe2
SHA1 32a8944e9a088a9de256710f5d5b52fe8843c34d
SHA512 b9bb5dd2b1226aeb4c70983c840e9039ecac9ed22b315d1c6ea0b4231b060ccdc07d1bc727b601925e7a3a58139559db7230dfba3c6a0fbcd9baede89e78b7ef
SSDEEP 6144:S5sMYod+X3oI+Y7meFekWjsMYod+X3oI+Y7meFeklsMYod+X3oI+Y7meFekw:g5d+X30ey35d+X30el5d+X30eE
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1364	msedge.exe
1364	msedge.exe
516	msedge.exe
516	msedge.exe
4760	identity_helper.exe
4760	identity_helper.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 2044	516	msedge.exe	81
PID 516 wrote to memory of 2044	516	msedge.exe	81
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 740	516	msedge.exe	82
PID 516 wrote to memory of 1364	516	msedge.exe	83
PID 516 wrote to memory of 1364	516	msedge.exe	83
PID 516 wrote to memory of 2520	516	msedge.exe	84
PID 516 wrote to memory of 2520	516	msedge.exe	84
PID 516 wrote to memory of 2520	516	msedge.exe	84
PID 516 wrote to memory of 2520	516	msedge.exe	84
PID 516 wrote to memory of 2520	516	msedge.exe	84
PID 516 wrote to memory of 2520	516	msedge.exe	84
PID 516 wrote to memory of 2520	516	msedge.exe	84
PID 516 wrote to memory of 2520	516	msedge.exe	84
PID 516 wrote to memory of 2520	516	msedge.exe	84
PID 516 wrote to memory of 2520	516	msedge.exe	84
PID 516 wrote to memory of 2520	516	msedge.exe	84
PID 516 wrote to memory of 2520	516	msedge.exe	84
PID 516 wrote to memory of 2520	516	msedge.exe	84
PID 516 wrote to memory of 2520	516	msedge.exe	84
PID 516 wrote to memory of 2520	516	msedge.exe	84
PID 516 wrote to memory of 2520	516	msedge.exe	84
PID 516 wrote to memory of 2520	516	msedge.exe	84
PID 516 wrote to memory of 2520	516	msedge.exe	84
PID 516 wrote to memory of 2520	516	msedge.exe	84
PID 516 wrote to memory of 2520	516	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9cdc3ab1ec0498cd16b1ce5d8573efe2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe413d46f8,0x7ffe413d4708,0x7ffe413d4718
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,1640549671252095837,10622150042852605731,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,1640549671252095837,10622150042852605731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,1640549671252095837,10622150042852605731,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,1640549671252095837,10622150042852605731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,1640549671252095837,10622150042852605731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,1640549671252095837,10622150042852605731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,1640549671252095837,10622150042852605731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,1640549671252095837,10622150042852605731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,1640549671252095837,10622150042852605731,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,1640549671252095837,10622150042852605731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,1640549671252095837,10622150042852605731,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,1640549671252095837,10622150042852605731,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

977ea2fb-5b15-437f-b5fa-969a1b1a64a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\977ea2fb-5b15-437f-b5fa-969a1b1a64a0.tmp
Size 10KB
SHA256 c5565c592dff63c4a677108b1cc184ac2d025ec8c4014cb21dcd93087149b644
MD5 24dbcaedfe6dc5018bade485b81e6852
SHA1 5a0c6f4fa1347e2b24e5e8f0c4eea0b30457d19f
SHA512 ac8100fca62434f4ff40758dba51e3c242de6eba86ece6035825f70319b313d17666e89711d4deb445e920112ee4cd16f6b75311ac72ee9920260cccebed5754
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup0kHe2RUdjf7Z53z2OMDCRk:A9iIxuERzA83h09RZxY0kvezZ5aOMWRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 8207ee8aedf769f0c2ddf75fa2902ce935a8449696cad1983fa4199caeb04711
MD5 b3c15ccf3f9d84e9d7e4dff816be661f
SHA1 08a5b28ee01dd11783bfbe61155c256ff1acefb6
SHA512 058422238e5815b3ce20f48ce4a906943454c1a61932b6a474b7e2f4a8b41dbccc5eb03d3c409c35e545f9e139c9989e4d4e4bf277acad804f05ca44c0dc6ebc
SSDEEP 96:nZk8gmY18ega9IQwpvWMoiVmdeHpCrFbA1ZUWQyV+VDCziEwb:nZk1x6NaCQGWMXpubYZro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 83d0380e34ed59968ff5189ead30b4430628c43167adcc4a876af120d49fda42
MD5 9285473f2aa18763ad88379aefe0baaa
SHA1 622a23e45047214d3bfc4b93d908ab219d17bbf5
SHA512 37ce5b1194547a66f00f91c6c4ee4c1814f7c0eb867affd2385e97a5e8491e059b4d0a37d37040d3f4ec56ea0d95f562aa73523d9070bbe8e352bc9b76022cb8
SSDEEP 96:nZkHgmY18vga9IQwpvWMoiVmdeHpCrFbA1ZUWQyV+VD7AiEwb:nZkAx6oaCQGWMXpubYZrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 af48872995354c38836fdd3cd4c6d80a842abd22fc5beba4a368c17915dc719e
MD5 9ffd68acf810b110c8689dd0a9b28f4c
SHA1 c04aa0d03e6a6bf6d73187e630054adbeed5ee2f
SHA512 650361a158b0cf79120ea5c61940efe07b44008ec6bac6b5a8d655f71ff8c9cf98b8a937a2be53d2e9e164ac23b5e5a5e356f9d58a2fc3485407ac75d52ce350
SSDEEP 96:nZkHgmY18ega9IQwpvWMoiVmdeHpCrFbA1ZUWQyV+VDCAiEwb:nZkAx6NaCQGWMXpubYZrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download