c52f5b83c84f95bd0231966277ba1e1f9b856555b6ebf155d90488632347af27

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 23:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2f32776926f520083806eb891068c42_JaffaCakes118.html
Size 213KB
Sample240612-3j8tesyfkk
SHA256 c52f5b83c84f95bd0231966277ba1e1f9b856555b6ebf155d90488632347af27
MD5 a2f32776926f520083806eb891068c42
SHA1 c8fda1a930ac83e353c1462c2e5a8e8f66d60702
SHA512 ba5799bf359e9f1fe4b7ae68ae788f483ae9ec4f3a83f3fe813f775823d80ce14e5099c9146b51bb87a3f3a662ecf01050caa7d071f5def39e3517d607b736a6
SSDEEP 1536:Di/BFDHItsKMDNIz6fHAqjqK0YBIWzz6qjqK0YBIm/nqjqK0YBID+gXtqjqK0YBo:+/Bz3zPb+6Z2BuS0TtI02vEN
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1624	msedge.exe
1624	msedge.exe
4436	identity_helper.exe
4436	identity_helper.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2912	1624	msedge.exe	81
PID 1624 wrote to memory of 2912	1624	msedge.exe	81
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 2024	1624	msedge.exe	82
PID 1624 wrote to memory of 1864	1624	msedge.exe	83
PID 1624 wrote to memory of 1864	1624	msedge.exe	83
PID 1624 wrote to memory of 1564	1624	msedge.exe	84
PID 1624 wrote to memory of 1564	1624	msedge.exe	84
PID 1624 wrote to memory of 1564	1624	msedge.exe	84
PID 1624 wrote to memory of 1564	1624	msedge.exe	84
PID 1624 wrote to memory of 1564	1624	msedge.exe	84
PID 1624 wrote to memory of 1564	1624	msedge.exe	84
PID 1624 wrote to memory of 1564	1624	msedge.exe	84
PID 1624 wrote to memory of 1564	1624	msedge.exe	84
PID 1624 wrote to memory of 1564	1624	msedge.exe	84
PID 1624 wrote to memory of 1564	1624	msedge.exe	84
PID 1624 wrote to memory of 1564	1624	msedge.exe	84
PID 1624 wrote to memory of 1564	1624	msedge.exe	84
PID 1624 wrote to memory of 1564	1624	msedge.exe	84
PID 1624 wrote to memory of 1564	1624	msedge.exe	84
PID 1624 wrote to memory of 1564	1624	msedge.exe	84
PID 1624 wrote to memory of 1564	1624	msedge.exe	84
PID 1624 wrote to memory of 1564	1624	msedge.exe	84
PID 1624 wrote to memory of 1564	1624	msedge.exe	84
PID 1624 wrote to memory of 1564	1624	msedge.exe	84
PID 1624 wrote to memory of 1564	1624	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a2f32776926f520083806eb891068c42_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffefebc46f8,0x7ffefebc4708,0x7ffefebc4718
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,6047523078610276430,4529089838708425563,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,6047523078610276430,4529089838708425563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,6047523078610276430,4529089838708425563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6047523078610276430,4529089838708425563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6047523078610276430,4529089838708425563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6047523078610276430,4529089838708425563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6047523078610276430,4529089838708425563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6047523078610276430,4529089838708425563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6047523078610276430,4529089838708425563,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6047523078610276430,4529089838708425563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6047523078610276430,4529089838708425563,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,6047523078610276430,4529089838708425563,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3104 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 477B
SHA256 0246969a8ed4b295567a52510a458cb2cf2766f69bbccbdffc26926376247014
MD5 395d0d94201c03bc9c4be9500199f598
SHA1 3520203e20061f53b07ec176810b29122580539f
SHA512 b90d542f7653b4e5645f7c3ca7f10bd63385b99e700fb4e03b5c0776b330ec638642a80b9283e65ea2d0947cfdd9c705db43dc677a133c55d5739fc2a81d7536
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 16eaadaabb89169e227549e6e138479bcb19dcdd9425b355185957e8acee1b53
MD5 2b47c922fee141c536163367a9a810fe
SHA1 a603a271ec4b34a54be4e76b6f58520d8e636d89
SHA512 94997477bdd319a8cac25293b8826de6b7ced73f7da508ecdccea26a18828ea408ab0c742121edef89be46a9f1c772af03084a5090b3b02894388d7093e12f76
SSDEEP 96:nhk/Rf15swpvWMoiVmdeHIqQtkb+UWQyV+VDCziEwb:nhkFXsGWMXdQkb+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 cdf0466a8627fc33d3b582d7e37657f3d152502eaf17dd7361327c1441568954
MD5 12388b5e50818952331547fd33fcad72
SHA1 efb5de492acba059d3da5ad694a2a506982cce95
SHA512 3be108b0b09f61b9c726ee5ca6b18df0edd295b8906b4ed1d4181c42b5bd39852d7ffac7e036236d6768a3466d2b6b30c240a63c798286a2ef03be73747461dc
SSDEEP 96:nhk/tf15kwpvWMoiVmdeEP+2IqQtkb+UWQyV+VD7AiEwb:nhkxXkGWMI+2dQkb+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 911a1c1e2f84b43564c2bf7cff8bc59c0277e0dc00b8e80e9b76418e809f3d8d
MD5 08da85512f91774f15904c76925aa32e
SHA1 19699bdc77ac69da35e3ad3842006321c89ba7e5
SHA512 ce7e3dd1c963b78689031e2c5e807a4f724bc3b4371a309e125a56d4267b4425e14bbe6241b3df799accfaf1e10aaaeefffa114e2aaae4160f17e80a60c24833
SSDEEP 96:nhk/tf15swpvWMoiVmdeH2IqQtkb+UWQyV+VDCAiEwb:nhkxXsGWMX2dQkb+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 cf5b67c1de33a3cf9203fe6d61dafd7228eeed62a686bcd66fbc363994ad8803
MD5 374e50afd33988a63e27fc8e9d11d212
SHA1 7462efdb2384a47e3466687e02a453e7e1767e47
SHA512 6485f34337c06f6c3acdfd462ff46691adf399fc7ee4577dc09439414af23da241a144b8d2be2b360771ccb3a83e7fd7c8b32ecd9ff54ae7df767ebb0fc042cd
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupOp07e2RUuddv23z2OMDCRJ:A9iIxuERzA83h09RZxYpr1H2aOMWRHqe
MD5 SHA1 SHA512 SSDEEP

Submit Download