9ab7aa5cc84cd15fd618bac1ddf1ba77b650b4a517977ccc1e10910cd2494aff

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a33ad6c47ab0d40e8c81248f3cf2f5e3_JaffaCakes118.html
Size 57KB
Sample240613-a6ymraxgmc
SHA256 9ab7aa5cc84cd15fd618bac1ddf1ba77b650b4a517977ccc1e10910cd2494aff
MD5 a33ad6c47ab0d40e8c81248f3cf2f5e3
SHA1 ffbe5deffd877d6587bbf4d596ee4b453a372f4e
SHA512 b054af8c4988f2b843079f31b0652358755a271d942f22a9de24b7e79759829bfa38588d17200db567a5b2fa24016c7f345932e08253eb544351d68e9dfa2098
SSDEEP 1536:1MXSQnRfatgeOBhguxWDzlT+ABOGdbbk3qb8tLJIEFR37aX:1mSkf7jqkaQtLJz37aX
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
3980	msedge.exe
3980	msedge.exe
2332	identity_helper.exe
2332	identity_helper.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 3008	3980	msedge.exe	81
PID 3980 wrote to memory of 3008	3980	msedge.exe	81
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 2444	3980	msedge.exe	82
PID 3980 wrote to memory of 1936	3980	msedge.exe	83
PID 3980 wrote to memory of 1936	3980	msedge.exe	83
PID 3980 wrote to memory of 2684	3980	msedge.exe	84
PID 3980 wrote to memory of 2684	3980	msedge.exe	84
PID 3980 wrote to memory of 2684	3980	msedge.exe	84
PID 3980 wrote to memory of 2684	3980	msedge.exe	84
PID 3980 wrote to memory of 2684	3980	msedge.exe	84
PID 3980 wrote to memory of 2684	3980	msedge.exe	84
PID 3980 wrote to memory of 2684	3980	msedge.exe	84
PID 3980 wrote to memory of 2684	3980	msedge.exe	84
PID 3980 wrote to memory of 2684	3980	msedge.exe	84
PID 3980 wrote to memory of 2684	3980	msedge.exe	84
PID 3980 wrote to memory of 2684	3980	msedge.exe	84
PID 3980 wrote to memory of 2684	3980	msedge.exe	84
PID 3980 wrote to memory of 2684	3980	msedge.exe	84
PID 3980 wrote to memory of 2684	3980	msedge.exe	84
PID 3980 wrote to memory of 2684	3980	msedge.exe	84
PID 3980 wrote to memory of 2684	3980	msedge.exe	84
PID 3980 wrote to memory of 2684	3980	msedge.exe	84
PID 3980 wrote to memory of 2684	3980	msedge.exe	84
PID 3980 wrote to memory of 2684	3980	msedge.exe	84
PID 3980 wrote to memory of 2684	3980	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a33ad6c47ab0d40e8c81248f3cf2f5e3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa087846f8,0x7ffa08784708,0x7ffa08784718
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,7923949093596931757,14478396252925670279,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,7923949093596931757,14478396252925670279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,7923949093596931757,14478396252925670279,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7923949093596931757,14478396252925670279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7923949093596931757,14478396252925670279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,7923949093596931757,14478396252925670279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,7923949093596931757,14478396252925670279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7923949093596931757,14478396252925670279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7923949093596931757,14478396252925670279,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7923949093596931757,14478396252925670279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7923949093596931757,14478396252925670279,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,7923949093596931757,14478396252925670279,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f0599a8525398ebe8610c5113e39308ae2d178bcac34607cfe662353fbd61ba0
MD5 cb9821bd435726051ea6d8acd92d914d
SHA1 9046e704e68be60fb806c2b105df00312e6fe973
SHA512 61d1b3b8ea17ec1bbd506b65a56b25e043f5246da44b68a125323c39732de008c243f170fed70d99918ed1151e497e1673da2c5b4d0d62bf15a65d41ae371c6c
SSDEEP 96:n6k0F1UM72wpvWMoiVmdeHk4UWUWQyV+VDCziEwb:n6k8uM72GWMXSWro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3dfb13f78dc62a250926726b4834be06d727d06f25deab34155174c714c4132f
MD5 93c8c32803807d59896f8ea3e090dbd5
SHA1 787307299615d23d0ecc0987cba8dfefe764960c
SHA512 8de02df6e24a5ba2859aed8d0b6e6b8fbae313aced6affa28f11b20f2f7c73322fbf6a4959c72225e955bd0d7c513c0f755a2336fefad10d3a381a75fa80db27
SSDEEP 96:n6k0F1UMx2wpvWMoiVmdeLH2k4UWUWQyV+VD7AiEwb:n6k8uMx2GWMbH2SWrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9f4f6ba84bd6268efb244947b0d35bb4b2c636d86e517050d5b2228c6abcf11b
MD5 c2a22d489161d83a4f9e372569769837
SHA1 c05bf2ef386b65db01bff00b187a7f62805ea636
SHA512 28549771431f129cf9ed68ad2a0032d4cb227a67ab6c0c73013dec65d339870a89dc06e6743758371190049a9bc969f82b2a97bb5609cbac547e80d1c2d1e660
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupdwe2RUNy4VN:A9iIxuERzA83h09RZxYIKN
MD5 SHA1 SHA512 SSDEEP

Submit Download