9aab281168f2329c9cf63ee9b3503616c0a4668ace871326abb8b1c79548fa84

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1125c933587af06aa6d65e52b1863ce_JaffaCakes118.html
Size 3KB
Sample240612-sct2ksshrr
SHA256 9aab281168f2329c9cf63ee9b3503616c0a4668ace871326abb8b1c79548fa84
MD5 a1125c933587af06aa6d65e52b1863ce
SHA1 c289576290a46a918452d232202b61efbf6ee67b
SHA512 ffea3a6ff5a7ad42ef768dd4a1234a7ddd68318c9a589cdbd9a2196a93d6b6abc28eda9418c02a106740bb8bc2444ca9f94007363e995259dabc054278d21510
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
4440	msedge.exe
4440	msedge.exe
3896	identity_helper.exe
3896	identity_helper.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 3076	4440	msedge.exe	82
PID 4440 wrote to memory of 3076	4440	msedge.exe	82
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 4656	4440	msedge.exe	83
PID 4440 wrote to memory of 3936	4440	msedge.exe	84
PID 4440 wrote to memory of 3936	4440	msedge.exe	84
PID 4440 wrote to memory of 2760	4440	msedge.exe	85
PID 4440 wrote to memory of 2760	4440	msedge.exe	85
PID 4440 wrote to memory of 2760	4440	msedge.exe	85
PID 4440 wrote to memory of 2760	4440	msedge.exe	85
PID 4440 wrote to memory of 2760	4440	msedge.exe	85
PID 4440 wrote to memory of 2760	4440	msedge.exe	85
PID 4440 wrote to memory of 2760	4440	msedge.exe	85
PID 4440 wrote to memory of 2760	4440	msedge.exe	85
PID 4440 wrote to memory of 2760	4440	msedge.exe	85
PID 4440 wrote to memory of 2760	4440	msedge.exe	85
PID 4440 wrote to memory of 2760	4440	msedge.exe	85
PID 4440 wrote to memory of 2760	4440	msedge.exe	85
PID 4440 wrote to memory of 2760	4440	msedge.exe	85
PID 4440 wrote to memory of 2760	4440	msedge.exe	85
PID 4440 wrote to memory of 2760	4440	msedge.exe	85
PID 4440 wrote to memory of 2760	4440	msedge.exe	85
PID 4440 wrote to memory of 2760	4440	msedge.exe	85
PID 4440 wrote to memory of 2760	4440	msedge.exe	85
PID 4440 wrote to memory of 2760	4440	msedge.exe	85
PID 4440 wrote to memory of 2760	4440	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a1125c933587af06aa6d65e52b1863ce_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffa025546f8,0x7ffa02554708,0x7ffa02554718
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,8927405158833131693,8952439840006611274,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,8927405158833131693,8952439840006611274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,8927405158833131693,8952439840006611274,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8927405158833131693,8952439840006611274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8927405158833131693,8952439840006611274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,8927405158833131693,8952439840006611274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,8927405158833131693,8952439840006611274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8927405158833131693,8952439840006611274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8927405158833131693,8952439840006611274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8927405158833131693,8952439840006611274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8927405158833131693,8952439840006611274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,8927405158833131693,8952439840006611274,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
MD5 c5abc082d9d9307e797b7e89a2f755f4
SHA1 54c442690a8727f1d3453b6452198d3ec4ec13df
SHA512 ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
MD5 b4a74bc775caf3de7fc9cde3c30ce482
SHA1 c6ed3161390e5493f71182a6cb98d51c9063775d
SHA512 55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6c56f663055bdc11a4735aaef4b9434f80ebb1c3b9c22b33bfc2415ea738e505
MD5 735ab868025888f7ab0d0e11d60f71d4
SHA1 97d12ddd6f6b1082980e3a1ae607aca371ce7e8a
SHA512 bc756192accef7449317999672656689d54cf5c8870eee28c6253eec50b14db9913f854d1a15423a5dd69affa7e78d07b3514bd4bf91dbebcc1000c9eb7201e6
SSDEEP 96:n/kVtV1HZIeEcwpvWMoiVmdeHnazpR+UWQyV+VD7AiEwb:n/kl1ZIebGWMXopR+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9d67030f7f9f24d94696055573e95fbc67c7eed2c3002ffc34444b4e55ec36dd
MD5 b7d9fb3243e326f9a4b6c9e05b5619a4
SHA1 ad4f66a520d8458c50cf806e56f7e472dee6b191
SHA512 db6ed124d3ed290e6f6067eeb7456f6c7943cec374a09bb662e7893b37bed594f98fd437d0f3f8f24cf516fe8f08d7456448fdbcaa4a2a6da322df61e581a477
SSDEEP 96:n/kVRV1HAeEcwpvWMoiVmdeHnazpR+UWQyV+VDCziEwb:n/kJ1AebGWMXopR+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4f70128900c5f61909a192b6cff87bcd2ff757b9229aa2babfd3dcce43f2ae52
MD5 5c7faa00b6ba0be0ec50150357185db8
SHA1 06da4aa18ef294f6e4783838490695a5e8d3fb5c
SHA512 1a0341bb5d3ada3e1dbd139f2581047f6d0476c8b4a353256cd6ecfbd62330f1d62cd133fd8ca3ed4b9a1ea01831d603aa8b6222c2b7095bacd235e7403a1322
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfSve2RU0Utu3z2OMDCRHq8:A9iIxuERzA83h09RZxYqX6uaOMWRHqlK
MD5 SHA1 SHA512 SSDEEP

Submit Download