63496c76ce2b28089af948ca61b0ef18cc866357f8064366883f4a7e90df613a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a29fc2005c9301b592fb1f479c6bc6c5_JaffaCakes118.html
Size 451KB
Sample240612-12jk5ssdqa
SHA256 63496c76ce2b28089af948ca61b0ef18cc866357f8064366883f4a7e90df613a
MD5 a29fc2005c9301b592fb1f479c6bc6c5
SHA1 1b4f0ac9112ed81f4cf412d5fb73952236b09aeb
SHA512 5085542cadf6d377e0abf08dbe103221cfab28e8d78e237ecba761651ef5471c1a64f5a4576f242c501a43d5bbf1582d3b856f4fa9cf28c6e1f335fe36d54c35
SSDEEP 6144:BlsMYod+X3oI+YzsMYod+X3oI+YwelsMYod+X3oI+YSsMYod+X3oI+YQ:L5d+X3h5d+X3aeR5d+X3u5d+X3+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
4736	msedge.exe
4736	msedge.exe
2224	identity_helper.exe
2224	identity_helper.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 1892	4736	msedge.exe	82
PID 4736 wrote to memory of 1892	4736	msedge.exe	82
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 3924	4736	msedge.exe	83
PID 4736 wrote to memory of 388	4736	msedge.exe	84
PID 4736 wrote to memory of 388	4736	msedge.exe	84
PID 4736 wrote to memory of 4408	4736	msedge.exe	85
PID 4736 wrote to memory of 4408	4736	msedge.exe	85
PID 4736 wrote to memory of 4408	4736	msedge.exe	85
PID 4736 wrote to memory of 4408	4736	msedge.exe	85
PID 4736 wrote to memory of 4408	4736	msedge.exe	85
PID 4736 wrote to memory of 4408	4736	msedge.exe	85
PID 4736 wrote to memory of 4408	4736	msedge.exe	85
PID 4736 wrote to memory of 4408	4736	msedge.exe	85
PID 4736 wrote to memory of 4408	4736	msedge.exe	85
PID 4736 wrote to memory of 4408	4736	msedge.exe	85
PID 4736 wrote to memory of 4408	4736	msedge.exe	85
PID 4736 wrote to memory of 4408	4736	msedge.exe	85
PID 4736 wrote to memory of 4408	4736	msedge.exe	85
PID 4736 wrote to memory of 4408	4736	msedge.exe	85
PID 4736 wrote to memory of 4408	4736	msedge.exe	85
PID 4736 wrote to memory of 4408	4736	msedge.exe	85
PID 4736 wrote to memory of 4408	4736	msedge.exe	85
PID 4736 wrote to memory of 4408	4736	msedge.exe	85
PID 4736 wrote to memory of 4408	4736	msedge.exe	85
PID 4736 wrote to memory of 4408	4736	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a29fc2005c9301b592fb1f479c6bc6c5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffe103746f8,0x7ffe10374708,0x7ffe10374718
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11211317594981976584,11496718434422523118,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,11211317594981976584,11496718434422523118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,11211317594981976584,11496718434422523118,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11211317594981976584,11496718434422523118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11211317594981976584,11496718434422523118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11211317594981976584,11496718434422523118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11211317594981976584,11496718434422523118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11211317594981976584,11496718434422523118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11211317594981976584,11496718434422523118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11211317594981976584,11496718434422523118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11211317594981976584,11496718434422523118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11211317594981976584,11496718434422523118,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4940 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
SHA1 86174e670c44767c08a39cc2a53c09c318326201
SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
MD5 b704c9ca0493bd4548ac9c69dc4a4f27
SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 183B
SHA256 1d26a34f3b686ef9b0f4402fd77dbbf4e517c3a60d31f19751f038953abe9e65
MD5 a28fc8c7b408c9fec7eb29ba72319a1a
SHA1 2b1815d04fb077e076a7c078db984304b82cf50e
SHA512 6a6f10e0011b2e2f335d65b2b5da07e47e06aa5eeb22ac8950f63928c18242952d216526c8a2ba909ad04fdaf073215c4277272c6de2a28c7cb39a211f0a78bb
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 79b0feae8155a70e2d271e1e7f57a2b9b27dfc0d269dffca97a16b558d507237
MD5 99e70b534cffddb67c9563c0218db5b3
SHA1 f415ead5a2efa5a14039c53d79ec5e7117e395fc
SHA512 28f8baeb4e292e4d79f77efad7257336ec0fc1a696e396ae31cf4f321bafd1d7311f8efe544344e46dda881a67911747896905821f2b43370265d772ab7c9c03
SSDEEP 96:n7ck/R81NovwpvWMoiVmdeH2Wfs+UWQyV+VDCziEwb:nwkqkvGWMX8+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c21765d9d724b8772e567967ead49a90e7adf2610be19d228a70b87b2ce20bce
MD5 a527a3585ed04861aa0583565b63d8bf
SHA1 a9c6c92fc65103904fc61511a1c1d3a8eca4e5dd
SHA512 bbd34b4c6202a654c7f03ad80fba5840340127b72ef6add93487b0a8aefa1e47cefa62949cf87e677482484617affae9b4492fc6edcd5a4d39f78b4a5b9188bd
SSDEEP 96:n7ck/t81NoKwpvWMoiVmdeH2Wfs+UWQyV+VD7AiEwb:nwkGkKGWMX8+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 775d1f95d0debcec1a8d6092b1f70b2399192c4c4748e833cbf204ad49c02e10
MD5 5437d0309cd36dd1d81497aa846d3b9b
SHA1 4a937b54a846477865cd8d66b19c7344ee00ca2d
SHA512 2d30e66b8b518ef8eaaf5180053f7e8fa81d519fcc3d6db9eee9467c38a67dd625c6b51d84802e3eacee130882ff5218d95c867761a5b8903f4395aa7ad306a6
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupbHf7e2RUHlh/G3z2OMDCRe:A9iIxuERzA83h09RZxYDj+GaOMWRHqlP
MD5 SHA1 SHA512 SSDEEP

Submit Download