5ecb7b6b14fdd95b8f8b75eefd33e391b7c89040da8d1e18c13b15f119dad653

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 00:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a328c78c88bc9dc34049cf67a6305fe5_JaffaCakes118.html
Size 17KB
Sample240613-avlttaxbrf
SHA256 5ecb7b6b14fdd95b8f8b75eefd33e391b7c89040da8d1e18c13b15f119dad653
MD5 a328c78c88bc9dc34049cf67a6305fe5
SHA1 b60e497f6934ad37398ed43095f6cc0423caf3cc
SHA512 cd9078cc092615ad8d63d20f6a8240eb503b87fb46aeff5d45100e0b9f08fd56594b29747fa8e06df20e5f4c5f80abe015edb68465ec7dd18d598d78502be964
SSDEEP 384:7yissU8Oc3y8QdoqgsDiADient1PI3Fd1PI3FkcOF0wZswbHsMWikKBbs4L:7yisd8OYQdoqgsuADiAt1Q3Fd1Q3Fkhr
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4536	msedge.exe
4536	msedge.exe
2592	identity_helper.exe
2592	identity_helper.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 380	4536	msedge.exe	82
PID 4536 wrote to memory of 380	4536	msedge.exe	82
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 2960	4536	msedge.exe	83
PID 4536 wrote to memory of 4700	4536	msedge.exe	84
PID 4536 wrote to memory of 4700	4536	msedge.exe	84
PID 4536 wrote to memory of 3792	4536	msedge.exe	85
PID 4536 wrote to memory of 3792	4536	msedge.exe	85
PID 4536 wrote to memory of 3792	4536	msedge.exe	85
PID 4536 wrote to memory of 3792	4536	msedge.exe	85
PID 4536 wrote to memory of 3792	4536	msedge.exe	85
PID 4536 wrote to memory of 3792	4536	msedge.exe	85
PID 4536 wrote to memory of 3792	4536	msedge.exe	85
PID 4536 wrote to memory of 3792	4536	msedge.exe	85
PID 4536 wrote to memory of 3792	4536	msedge.exe	85
PID 4536 wrote to memory of 3792	4536	msedge.exe	85
PID 4536 wrote to memory of 3792	4536	msedge.exe	85
PID 4536 wrote to memory of 3792	4536	msedge.exe	85
PID 4536 wrote to memory of 3792	4536	msedge.exe	85
PID 4536 wrote to memory of 3792	4536	msedge.exe	85
PID 4536 wrote to memory of 3792	4536	msedge.exe	85
PID 4536 wrote to memory of 3792	4536	msedge.exe	85
PID 4536 wrote to memory of 3792	4536	msedge.exe	85
PID 4536 wrote to memory of 3792	4536	msedge.exe	85
PID 4536 wrote to memory of 3792	4536	msedge.exe	85
PID 4536 wrote to memory of 3792	4536	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a328c78c88bc9dc34049cf67a6305fe5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ff9526946f8,0x7ff952694708,0x7ff952694718
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6404950560311809713,708574789933814207,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6404950560311809713,708574789933814207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,6404950560311809713,708574789933814207,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6404950560311809713,708574789933814207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6404950560311809713,708574789933814207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6404950560311809713,708574789933814207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6404950560311809713,708574789933814207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6404950560311809713,708574789933814207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6404950560311809713,708574789933814207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6404950560311809713,708574789933814207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6404950560311809713,708574789933814207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6404950560311809713,708574789933814207,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
MD5 c5abc082d9d9307e797b7e89a2f755f4
SHA1 54c442690a8727f1d3453b6452198d3ec4ec13df
SHA512 ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
MD5 b4a74bc775caf3de7fc9cde3c30ce482
SHA1 c6ed3161390e5493f71182a6cb98d51c9063775d
SHA512 55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0c497c9a5f62a1dc5ddde620077747674418f9b14a5e423f2f8de9a5afdc9e74
MD5 853e2636b37fe15faa6d0646e139dcaf
SHA1 fc179e342a8bfc432f9c6684e3a67af0764029b9
SHA512 bdf7d6f141236f8d88d0a471f68323d8c42c988491971ddbe0150578bf0c941951c9664c08dfe0158665ca90ba36540b715c2df8e11c09d5ee6536aac8be2fda
SSDEEP 96:nSkfoxm/DQYmqcY1RJaNeEcwpvWMoiVmdeHnaHUWQyV+VDCziEwb:nSkhILY7JaNebGWMXYro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1a8b20ca8ec83880147bc50c003590ef3e83c5da13494ddbffed1d7900e5de8e
MD5 7e105f453755c07420c01f83fd268e0f
SHA1 e412ca71ab2aa27ec13f9e0815f10caecb664d9c
SHA512 0fd04b752b0a2f02a5e1a0353f59b4a729c1626553c5c2bdcd768f4eb8e9cc0f50ecc49da2c34cb60e9bab60ff4203c4d2ac487244beb6c33e0830d9d882013d
SSDEEP 96:nSkfoxm/DnmqcY1RJaNeEcwpvWMoiVmde02naHUWQyV+VD7AiEwb:nSkh6LY7JaNebGWME2Yrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6c29d7983fd0824ad3515104a6715102ab2a28aba8139d6a3d2f538a120914f7
MD5 1189df7062c4e8ef7c2985b7348308dd
SHA1 c797af6b0ef1930e6a51975d3e2ea7a641e89506
SHA512 f15ff6fd4a5c24391aa717487ef047e5a3f3e673b5901c8f767a174adc5d54bf0513bf6b23e2d62558b91db2a21e8a108b344a0bab386ad714f7382f249430d0
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup2lSVe2RUCUtS3z2OMDCRH3:A9iIxuERzA83h09RZxY/RgSaOMWRHqlu
MD5 SHA1 SHA512 SSDEEP

Submit Download