03d5d4b584eb574b9bc2c85f89aeecaa1bfe5075096387e9703184e8136cf298

Analysis

max time kernel
134s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3b4bcf94be455e9da6c9706faa4b293_JaffaCakes118.html
Size 32KB
Sample240613-d891cataja
SHA256 03d5d4b584eb574b9bc2c85f89aeecaa1bfe5075096387e9703184e8136cf298
MD5 a3b4bcf94be455e9da6c9706faa4b293
SHA1 5c6fd4672a8a58b7080c800bddf89b24137eb745
SHA512 c13337e2a6719d78afb68b6cd82ecefa68c292e1c0afb65d002c331df19baa8dbecafffadee73757fe887c38da3ccea1b7be422015a736ded14ec6cfdecea5d6
SSDEEP 192:uw/Bb5nWvenQjxn5Q/6nQieBNninQOkEntuEnQTbnZnQmIQxT6ibS2Ev/G8p6J96:KnQ/FRx0//GryOUT
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
432	msedge.exe
432	msedge.exe
1240	identity_helper.exe
1240	identity_helper.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 1220	432	msedge.exe	82
PID 432 wrote to memory of 1220	432	msedge.exe	82
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 692	432	msedge.exe	83
PID 432 wrote to memory of 1640	432	msedge.exe	84
PID 432 wrote to memory of 1640	432	msedge.exe	84
PID 432 wrote to memory of 8	432	msedge.exe	85
PID 432 wrote to memory of 8	432	msedge.exe	85
PID 432 wrote to memory of 8	432	msedge.exe	85
PID 432 wrote to memory of 8	432	msedge.exe	85
PID 432 wrote to memory of 8	432	msedge.exe	85
PID 432 wrote to memory of 8	432	msedge.exe	85
PID 432 wrote to memory of 8	432	msedge.exe	85
PID 432 wrote to memory of 8	432	msedge.exe	85
PID 432 wrote to memory of 8	432	msedge.exe	85
PID 432 wrote to memory of 8	432	msedge.exe	85
PID 432 wrote to memory of 8	432	msedge.exe	85
PID 432 wrote to memory of 8	432	msedge.exe	85
PID 432 wrote to memory of 8	432	msedge.exe	85
PID 432 wrote to memory of 8	432	msedge.exe	85
PID 432 wrote to memory of 8	432	msedge.exe	85
PID 432 wrote to memory of 8	432	msedge.exe	85
PID 432 wrote to memory of 8	432	msedge.exe	85
PID 432 wrote to memory of 8	432	msedge.exe	85
PID 432 wrote to memory of 8	432	msedge.exe	85
PID 432 wrote to memory of 8	432	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3b4bcf94be455e9da6c9706faa4b293_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe857546f8,0x7ffe85754708,0x7ffe85754718
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,6903766461439053422,8019422612130368600,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,6903766461439053422,8019422612130368600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,6903766461439053422,8019422612130368600,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6903766461439053422,8019422612130368600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6903766461439053422,8019422612130368600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6903766461439053422,8019422612130368600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1708 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6903766461439053422,8019422612130368600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6903766461439053422,8019422612130368600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1912 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6903766461439053422,8019422612130368600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6903766461439053422,8019422612130368600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6903766461439053422,8019422612130368600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,6903766461439053422,8019422612130368600,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3416 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 26d3d262d559f06825ca7295e0a7796679e8b7500159a6f4d29a8410aea09be9
MD5 7b072f0ad279c4d2f43907947e7d1464
SHA1 b698f20db82fa29e210309e4f19e7191c2c2ad07
SHA512 c82476a39fb85b5c4cba38ce8826362b2b744c3a20452ec5fe3a054a1466bc326e9fa401ba3a79b6d103e466159fb2b9b5f494c56fad35e32ac0472e9919c628
SSDEEP 96:nekVoxm/DQYmqxE1LHwwpvWMoiVmdeHIqQiy8UWQyV+VDCziEwb:nekfIqEJwGWMXd/y8ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 faaa8cbdc406f5e73a44d6b9f48817ec11888ad177ff9efe530f0bd9e087f774
MD5 fabff9f80bcef8454586294755b8a677
SHA1 68e31f68a520c52222f08f8df1f2bec7a525f1ef
SHA512 5068dbc6a18c5ce22b785c6ae47d1d0910be2229f836094ce9d94fee521dd3b777ed5584d0c1dbba50ebf57f52a05221b50b1b86585c8874e6560c5e28394fed
SSDEEP 96:nekVoxm/DnmqxE1LHGwpvWMoiVmdeHIqQiy8UWQyV+VDCAiEwb:nekf6qEJGGWMXd/y8rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0b4fc16338fe194189b868a1bf61648e8fb22037a16fbe44ed6960cc8ac33876
MD5 1ffa660bf41ea972e7122a7671305f1e
SHA1 453bb5d0b31020949f72b248aa34ecd4126c7d97
SHA512 5537deafbe5ed5e7c746d04bba451aea9997ff5c0d196d5021f4ea80ded8e95482c6f577719596803abaa36a7b536fbfc136f6ab8f94170e659cd4f5cef52436
SSDEEP 96:nekVoxm/DnmqxE1LHwwpvWMoiVmdeHIqQiy8UWQyV+VDCAiEwb:nekf6qEJwGWMXd/y8rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 de1f94ef2c21d6fa205dc98fb5969aa3004db95e045b2cd4109aaa5269322067
MD5 da2c801619c85272dd24bd44f0f4bbf3
SHA1 ea6e9e868bf172fe95019464dba3300b991fbb10
SHA512 7e938a277d378e9bd407f4cd0d22270eaa73876148f6bea6787748926d0e201e4a86f9536701842b9f9121153a44c01977b5cdb5acfef6e6446c953d6b8fcca2
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupEp0ze2RUidvzM3z2OMDCRU:A9iIxuERzA83h09RZxYTjhzMaOMWRHqD
MD5 SHA1 SHA512 SSDEEP

Submit Download