66d2d35af164950e7d7fb0890df7d16c7197765e8111881e545810284d04bb81

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2cbdad3b2a71def057bc4270f9ee852_JaffaCakes118.html
Size 19KB
Sample240612-2tesnaxflk
SHA256 66d2d35af164950e7d7fb0890df7d16c7197765e8111881e545810284d04bb81
MD5 a2cbdad3b2a71def057bc4270f9ee852
SHA1 6e901f374348c1504aa38a11bec95b6725081903
SHA512 136fd1820ad4ba8255e2eb8e90d72c47154a77a929742ab7828fe1d527cfa183324dc96d2bc61a34054b9da740f932c2cf8ec5ba066bafdfbf30933835bae844
SSDEEP 384:1G9iQi9ykHxASRv5fDtgq5wy9WcSW6FW9aFL466GF/UVoj/bpqt8z2Ikfdk+V0l5:1qzYykHxASRv5f5gq5w2WcSW6FW9aFLZ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
660	msedge.exe
660	msedge.exe
700	msedge.exe
700	msedge.exe
4112	identity_helper.exe
4112	identity_helper.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 4568	700	msedge.exe	86
PID 700 wrote to memory of 4568	700	msedge.exe	86
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 1068	700	msedge.exe	87
PID 700 wrote to memory of 660	700	msedge.exe	88
PID 700 wrote to memory of 660	700	msedge.exe	88
PID 700 wrote to memory of 3004	700	msedge.exe	89
PID 700 wrote to memory of 3004	700	msedge.exe	89
PID 700 wrote to memory of 3004	700	msedge.exe	89
PID 700 wrote to memory of 3004	700	msedge.exe	89
PID 700 wrote to memory of 3004	700	msedge.exe	89
PID 700 wrote to memory of 3004	700	msedge.exe	89
PID 700 wrote to memory of 3004	700	msedge.exe	89
PID 700 wrote to memory of 3004	700	msedge.exe	89
PID 700 wrote to memory of 3004	700	msedge.exe	89
PID 700 wrote to memory of 3004	700	msedge.exe	89
PID 700 wrote to memory of 3004	700	msedge.exe	89
PID 700 wrote to memory of 3004	700	msedge.exe	89
PID 700 wrote to memory of 3004	700	msedge.exe	89
PID 700 wrote to memory of 3004	700	msedge.exe	89
PID 700 wrote to memory of 3004	700	msedge.exe	89
PID 700 wrote to memory of 3004	700	msedge.exe	89
PID 700 wrote to memory of 3004	700	msedge.exe	89
PID 700 wrote to memory of 3004	700	msedge.exe	89
PID 700 wrote to memory of 3004	700	msedge.exe	89
PID 700 wrote to memory of 3004	700	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a2cbdad3b2a71def057bc4270f9ee852_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b7446f8,0x7ff82b744708,0x7ff82b744718
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12901374312620927937,15202871835521580464,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,12901374312620927937,15202871835521580464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,12901374312620927937,15202871835521580464,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12901374312620927937,15202871835521580464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12901374312620927937,15202871835521580464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12901374312620927937,15202871835521580464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12901374312620927937,15202871835521580464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12901374312620927937,15202871835521580464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12901374312620927937,15202871835521580464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12901374312620927937,15202871835521580464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12901374312620927937,15202871835521580464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12901374312620927937,15202871835521580464,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
MD5 c5abc082d9d9307e797b7e89a2f755f4
SHA1 54c442690a8727f1d3453b6452198d3ec4ec13df
SHA512 ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
MD5 b4a74bc775caf3de7fc9cde3c30ce482
SHA1 c6ed3161390e5493f71182a6cb98d51c9063775d
SHA512 55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 703B
SHA256 4c79b6419a733ad6fb25534ab7c9c6e5383fe4e3d886683b2bfe3d4d525330b7
MD5 e8eefa13df1f992587fde36f61b2fad1
SHA1 a07f03151b3f8f61124327384e2a328734b08ee4
SHA512 3530d33d00eee4c089e53e07cad91bdc1540aeeb8c56bfdbe8dede6afaa65359fc7223b7f6d198d0f54fbc30aedac6770d1bf6a15a8a7cf3c9427f7d06ac160e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1ad7109f1328956f66bd4cce715abea3b7e7c0639a72a563e163888fe3db41e6
MD5 cc39fa1bc44a545ee9055c925005ef78
SHA1 bdbd675b1ecb92ad2e79b1a06ae8e5bd1ea26195
SHA512 5fa85e5de624a0a02b0433c6807a8c2ee888fd312301b1845c37848a16fddcb6e6f7e878715ab01304248262d8fb1c6a1d81885399c612b691ec7e58c2c8e1c8
SSDEEP 96:nZFkBtphR1tseEcwpvWMoiVmdeY2na7Y+UWQyV+VD7AiEwb:nZFk9bvsebGWMI2kY+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 943e7f25c64c2503493e1baca93ab594f6e05eea3652974e0634075508d1e1ab
MD5 726fe9fcb1aa364969ef1ea407c20bc9
SHA1 05714b1b8b05487257e357e25e110996cc75b0e3
SHA512 36f63d8ee7c35c54b2e8af0433bc82a48e27b63f81ac7de3bb8ba27a7c7d4eb2789e77dd69f711d1d15f9ac0ba9b9eb1b7a5744a3ee4fc55a3a4a4493851d47b
SSDEEP 96:nZFkBRphR1tUeEcwpvWMoiVmdeHna7Y+UWQyV+VD7ziEwb:nZFkhbvUebGWMXkY+rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3dc9e0bcda0cf72ec183ef9a2f99cf470a5df97f8dcc9d7ebf1df2354ffe2e02
MD5 9cc0a191ede811ffe0786a6939493a1a
SHA1 7c21f1975f70be0e9c69cb2afeb1ca752c8a715d
SHA512 d8c06bd0acf2aac594adbe98e8207a3fc58189f66502a7f1bb591c64d34bc7fc0ce115f7a3e502a4bb50d0c60830d95b2ffae1091f260af27279e5eefcc97351
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupOSme2RUodUt/B3z2OMDCRN:A9iIxuERzA83h09RZxYjo+JaOMWRHql4
MD5 SHA1 SHA512 SSDEEP

Submit Download