3eafaeb56c1dca6efd1b1ba7fc5c4eeed530ea472eec3a01ac8a88ba70d4223d

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a35edf0cf29c8af1fb43f04f1ba93e9a_JaffaCakes118.html
Size 85KB
Sample240613-bxh2dashjn
SHA256 3eafaeb56c1dca6efd1b1ba7fc5c4eeed530ea472eec3a01ac8a88ba70d4223d
MD5 a35edf0cf29c8af1fb43f04f1ba93e9a
SHA1 10c6942b89ae003f639b997a32536f953aa56570
SHA512 4d5dbd9621df6b743d1ed37d3a7c14a789e3e9d003c5a43790f8701b90747ac2329490bf71418ee1225154ece3c7b1db9c7f7bc3a13dfb3b0dc5f325cb94b3cd
SSDEEP 1536:MtGx8WepGpIT800PMsdPky2LVoS1q+KauSOwgXSks8UuW6UeU8h3CzHEC0Hy:MtG7pUGsOWKU8h3CzHEC0Hy
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
4916	msedge.exe
4916	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 3004	4916	msedge.exe	81
PID 4916 wrote to memory of 3004	4916	msedge.exe	81
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 4668	4916	msedge.exe	83
PID 4916 wrote to memory of 3868	4916	msedge.exe	84
PID 4916 wrote to memory of 3868	4916	msedge.exe	84
PID 4916 wrote to memory of 4868	4916	msedge.exe	85
PID 4916 wrote to memory of 4868	4916	msedge.exe	85
PID 4916 wrote to memory of 4868	4916	msedge.exe	85
PID 4916 wrote to memory of 4868	4916	msedge.exe	85
PID 4916 wrote to memory of 4868	4916	msedge.exe	85
PID 4916 wrote to memory of 4868	4916	msedge.exe	85
PID 4916 wrote to memory of 4868	4916	msedge.exe	85
PID 4916 wrote to memory of 4868	4916	msedge.exe	85
PID 4916 wrote to memory of 4868	4916	msedge.exe	85
PID 4916 wrote to memory of 4868	4916	msedge.exe	85
PID 4916 wrote to memory of 4868	4916	msedge.exe	85
PID 4916 wrote to memory of 4868	4916	msedge.exe	85
PID 4916 wrote to memory of 4868	4916	msedge.exe	85
PID 4916 wrote to memory of 4868	4916	msedge.exe	85
PID 4916 wrote to memory of 4868	4916	msedge.exe	85
PID 4916 wrote to memory of 4868	4916	msedge.exe	85
PID 4916 wrote to memory of 4868	4916	msedge.exe	85
PID 4916 wrote to memory of 4868	4916	msedge.exe	85
PID 4916 wrote to memory of 4868	4916	msedge.exe	85
PID 4916 wrote to memory of 4868	4916	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a35edf0cf29c8af1fb43f04f1ba93e9a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa405846f8,0x7ffa40584708,0x7ffa40584718
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,11839465113251667705,11929831926504788836,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,11839465113251667705,11929831926504788836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,11839465113251667705,11929831926504788836,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11839465113251667705,11929831926504788836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11839465113251667705,11929831926504788836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11839465113251667705,11929831926504788836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11839465113251667705,11929831926504788836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11839465113251667705,11929831926504788836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11839465113251667705,11929831926504788836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11839465113251667705,11929831926504788836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2160 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11839465113251667705,11929831926504788836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1380 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,11839465113251667705,11929831926504788836,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5740 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
SHA1 86174e670c44767c08a39cc2a53c09c318326201
SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
MD5 b704c9ca0493bd4548ac9c69dc4a4f27
SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
MD5 SHA1 SHA512

Submit Download

143106fc-0280-4de8-a327-6a17afb57c4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\143106fc-0280-4de8-a327-6a17afb57c4a.tmp
Size 1KB
SHA256 bce60e343c87be3de9f4af5b8f16f3ea1cd38226bbd61ee4742c4d6b43d5a7bc
MD5 2cb47556533c721d75aa0ead2dba1b51
SHA1 a5f9199e286257ff79a9d0ab925a7ada3219a09a
SHA512 a1d8d1d5cc856efcb6513032b6f528eafedd2d47448c95193dc5ba60d7e2c993331c6aa51b1ccee4516c84ab8963108da5153fbb52ae8b470613f4244d23bd7f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 a97c9652b533031b4b1ab222d0cf120344088e8242585dfa6658655d3eea465b
MD5 eb9d9de7cbfa4a0961e8ccd97c2b032d
SHA1 7c529c3c605329e999749cd3cd159e4ea76208c9
SHA512 d76c09941ccb571b37caeca93e776136c0386d53583e14db465a0f07e99cb9f5f35d2000363c59fb3b571f33e3018316101e1c88b6c6545d9c0815d5664a7816
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ce1c49b9a8c6d8b017599119d698ddb7f2fd8d7a0a1881a2e24baab41267ece5
MD5 5289ab63d13bc2050ee27765c2b3242c
SHA1 27c935898d250e18bf9433ab66856604e05e9ece
SHA512 4259fba7c7f6b5e69e5a159d33a52098fee9e37dbb277d042662902feccb4d54d591a9034931cde705798e429360168fb1cd9e05641918309485b2616691694e
SSDEEP 96:nnkfoxm/Dnmqw91zJaQwpvWMoiVmdenQU1F22WfSUWQyV+VDCAiEwb:nnkh699BJaQGWM3QU1F2CrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f1a6b46b9bd7219e0e9a3e94915c0a8d671f157b0e04f0aad0e7916ea1e92188
MD5 8a1c5519e7f0ed2be0dcdb3907c9674d
SHA1 43044e4c610a884feaaddc49fdce528dad9d79f7
SHA512 e38b363e09f0a7bd426871905fabdd9cd5a3a0d5e45d992b19e8aa077bc662e8b402abc2f1046f66f26d8c825f770e4a5607a71534efbd84f55fa912ec300a1f
SSDEEP 96:nnkfoxm/DQYmqw91zJaQwpvWMoiVmdeH2WfSUWQyV+VDCziEwb:nnkhI99BJaQGWMXCro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 caa9df4b8690aaf00d91ef13e2e96799582775368a3c06ea30f802975ff743be
MD5 fe955f88d79881e0368587b68465c891
SHA1 072b9c73ae684c0e13c72acd68fb2a13198ceb11
SHA512 00a4f71600fb9d999e7d987263ed845b703fba77c1d1ee3b42e184babef2d940e139496c2a271fd5512c9841adaf26e6398c449098eaa1ea294b6bf2a8e8970c
SSDEEP 96:nnkfoxm/Dnmqw91zJaqwpvWMoiVmdeXHAQU1F22WuSUWQyV+VDCAiEwb:nnkh699BJaqGWMnHAQU1F2prV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 650ae314f90ea43ff01167d25dc9790315f70c03d00e53fdc7166f5300fdba23
MD5 b9b4ba98fbac5694b3eb4bec829b2cdb
SHA1 f25bd8c07a8fe9950f1460ce3309420bb9449ff1
SHA512 30c2c754d17cbe6b472ac25876053564bddb6f2eddf0a64ef072ca99e8965a35356bade6714a6017179ef34ca5adb240e3a9796903525d57450b421be26610aa
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphdQHfie2RU2h/K3z2OMDCp:A9iIxuERzA83h09RZxYhdiUNKaOMWRHH
MD5 SHA1 SHA512 SSDEEP

Submit Download