e064a9ebb1e3d51bd2f121eb171a0e9100b4c89c8044a2c6f670d1f90090c6d4

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6a8e49034667b7d58a4f5a5708e13aa_JaffaCakes118.html
Size 20KB
Sample240613-1dgrmsvbqk
SHA256 e064a9ebb1e3d51bd2f121eb171a0e9100b4c89c8044a2c6f670d1f90090c6d4
MD5 a6a8e49034667b7d58a4f5a5708e13aa
SHA1 8bb41ecccc37b7dd5de8e215e630a1f099dfbe72
SHA512 28996a0004407b7fe988fc4c77164d46798e59ef6ddeb8388edc4e11bcb5ddeaf9028ca679cec646f34a808fd4599edbde3b21c9ff62e6007a09a00ef9719669
SSDEEP 384:Slghs8Fvur0/e4HBWXFWIKmofWVWIOW2Bdgp:SOrFvc024hWXFW1PWVWlW2BdE
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
1440	msedge.exe
1440	msedge.exe
680	identity_helper.exe
680	identity_helper.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 1460	1440	msedge.exe	80
PID 1440 wrote to memory of 1460	1440	msedge.exe	80
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4640	1440	msedge.exe	81
PID 1440 wrote to memory of 4212	1440	msedge.exe	82
PID 1440 wrote to memory of 4212	1440	msedge.exe	82
PID 1440 wrote to memory of 4024	1440	msedge.exe	83
PID 1440 wrote to memory of 4024	1440	msedge.exe	83
PID 1440 wrote to memory of 4024	1440	msedge.exe	83
PID 1440 wrote to memory of 4024	1440	msedge.exe	83
PID 1440 wrote to memory of 4024	1440	msedge.exe	83
PID 1440 wrote to memory of 4024	1440	msedge.exe	83
PID 1440 wrote to memory of 4024	1440	msedge.exe	83
PID 1440 wrote to memory of 4024	1440	msedge.exe	83
PID 1440 wrote to memory of 4024	1440	msedge.exe	83
PID 1440 wrote to memory of 4024	1440	msedge.exe	83
PID 1440 wrote to memory of 4024	1440	msedge.exe	83
PID 1440 wrote to memory of 4024	1440	msedge.exe	83
PID 1440 wrote to memory of 4024	1440	msedge.exe	83
PID 1440 wrote to memory of 4024	1440	msedge.exe	83
PID 1440 wrote to memory of 4024	1440	msedge.exe	83
PID 1440 wrote to memory of 4024	1440	msedge.exe	83
PID 1440 wrote to memory of 4024	1440	msedge.exe	83
PID 1440 wrote to memory of 4024	1440	msedge.exe	83
PID 1440 wrote to memory of 4024	1440	msedge.exe	83
PID 1440 wrote to memory of 4024	1440	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a6a8e49034667b7d58a4f5a5708e13aa_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd168946f8,0x7ffd16894708,0x7ffd16894718
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,16768199232448052764,2538845372749687381,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,16768199232448052764,2538845372749687381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,16768199232448052764,2538845372749687381,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16768199232448052764,2538845372749687381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16768199232448052764,2538845372749687381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,16768199232448052764,2538845372749687381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,16768199232448052764,2538845372749687381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16768199232448052764,2538845372749687381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16768199232448052764,2538845372749687381,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16768199232448052764,2538845372749687381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16768199232448052764,2538845372749687381,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,16768199232448052764,2538845372749687381,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 0b3e4417d2b152daea7d185cf8a9ed90b44ea5fd3aa95935e12eebf6137fbd97
MD5 3aa2e1f7bb5e074274928184bbf135b1
SHA1 d17b9d629b425d9d5a99913515a7ee3caff2747b
SHA512 74be7cd3b8a793a0901cead653160a0da5047c3d49458bf1d67a277e2a0f1b61dd684785edfcab1fcd0fad6070d8d12593d9dc7e4977f874b9eb6ef6914bf28b
SSDEEP 96:nNk0C1w72wpvWMoiVmdeHk41Q+UWQyV+VDCziEwb:nNkv272GWMXk+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3df913c22b57649c5ddf1b2fbb28e933fcdaef914e6318416a467aa6d9d0e535
MD5 eabf6562f6f226a9f26d701b1a7bab28
SHA1 a902fb5621005c5d85c660dda161d45d651e08e6
SHA512 934bbc97333e2ada6662f5567ec49607f21bafb8e2b772d9ef6cda163b11cbb7364fa1c96209ce8e15eeb841470d21099511ef252b3849df6e3afd5ab055c23c
SSDEEP 96:nNk0C1wv2wpvWMoiVmdeE8qk41Q+UWQyV+VD7AiEwb:nNkv2v2GWMfqk+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cc5d34c1bd2c5066c9d75818e6d9cd442d30c1109c8b7d1bbd21beeb6ee87f21
MD5 8327c20948a99910817e9920d374da82
SHA1 43c3c30d392425daeb2cf6eaa0a5f78285ca2ea9
SHA512 991e7e647f14919d6903608045cdfdb33a486a7c01fcab972809d069865d64e048e5ef00023c060103789662aa731a3ca5d43729c6511046120cfe0ca5ef02bc
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupdvPe2RUqy4VW:A9iIxuERzA83h09RZxYN3dW
MD5 SHA1 SHA512 SSDEEP

Submit Download