ed80fcc9ea73fb7a1689339e28ed0bcb8693a971750faa38bd57a98ae7e73ba3

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3a6a5152f1d52aaaa8e3e23c02f19c8_JaffaCakes118.html
Size 42KB
Sample240613-dvc4fssenc
SHA256 ed80fcc9ea73fb7a1689339e28ed0bcb8693a971750faa38bd57a98ae7e73ba3
MD5 a3a6a5152f1d52aaaa8e3e23c02f19c8
SHA1 a7821ba7db09e444887188e4abbd3892eb663aa0
SHA512 d99ba71e20748957b3d26a6f6dfbd8282508049bc9472a12650b511698139ba4dfeaf64ae288739173c48ced106a40ddba54885bd0996e56153460c3b09b33e2
SSDEEP 768:lNwWwtlgixBlHSiSgJKOd4Nvp/RlkxLslKHQrAH5IdcqpKQkXOlJYAxNJv9Opn0f:lNDwtlgixB5SiSgJKOd4Nvp/RlkxLslz
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
1928	msedge.exe
1928	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1928	msedge.exe
1928	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 3164	1928	msedge.exe	81
PID 1928 wrote to memory of 3164	1928	msedge.exe	81
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 1620	1928	msedge.exe	82
PID 1928 wrote to memory of 384	1928	msedge.exe	83
PID 1928 wrote to memory of 384	1928	msedge.exe	83
PID 1928 wrote to memory of 1364	1928	msedge.exe	84
PID 1928 wrote to memory of 1364	1928	msedge.exe	84
PID 1928 wrote to memory of 1364	1928	msedge.exe	84
PID 1928 wrote to memory of 1364	1928	msedge.exe	84
PID 1928 wrote to memory of 1364	1928	msedge.exe	84
PID 1928 wrote to memory of 1364	1928	msedge.exe	84
PID 1928 wrote to memory of 1364	1928	msedge.exe	84
PID 1928 wrote to memory of 1364	1928	msedge.exe	84
PID 1928 wrote to memory of 1364	1928	msedge.exe	84
PID 1928 wrote to memory of 1364	1928	msedge.exe	84
PID 1928 wrote to memory of 1364	1928	msedge.exe	84
PID 1928 wrote to memory of 1364	1928	msedge.exe	84
PID 1928 wrote to memory of 1364	1928	msedge.exe	84
PID 1928 wrote to memory of 1364	1928	msedge.exe	84
PID 1928 wrote to memory of 1364	1928	msedge.exe	84
PID 1928 wrote to memory of 1364	1928	msedge.exe	84
PID 1928 wrote to memory of 1364	1928	msedge.exe	84
PID 1928 wrote to memory of 1364	1928	msedge.exe	84
PID 1928 wrote to memory of 1364	1928	msedge.exe	84
PID 1928 wrote to memory of 1364	1928	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3a6a5152f1d52aaaa8e3e23c02f19c8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff912ed46f8,0x7ff912ed4708,0x7ff912ed4718
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5570222098200711937,16724338533651583627,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,5570222098200711937,16724338533651583627,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,5570222098200711937,16724338533651583627,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5570222098200711937,16724338533651583627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5570222098200711937,16724338533651583627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5570222098200711937,16724338533651583627,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 3efca4945d5dd3f2231b396f07d9764aaf32baf136433817c50e61bc4b9f637d
MD5 f002db13b81233251ee0e07e99cdd455
SHA1 df3b45d9205f570553c272df746fc64f711a5e8b
SHA512 a58d5a9885af37ee79f7a4c4ccf82a1d9a3edf41bed4fcc87aeac206726479c023fb1e1969a0dafec99d369ab58952fe0c71576c86d944a1a07202557514236c
SSDEEP 96:nak0H1a72wpvWMoiVmdeHk4CFEUWQyV+VDCziEwb:nakas72GWMX8FEro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 517baf013bcd7685f22e663bbaf42e4f8b7b40548a18422420b7766734863b22
MD5 4b48a96522b0d8ae5b30198b571a4dce
SHA1 719d62d8f9dec6d78f39da329511fd45c865b42e
SHA512 bbf3a539656e21dc64688d59a950bdf60bb3b7e88fd4f2709fd3d21f3df280d432fb9aa049b265b665477919addfca7bbcb388ed0e290b355f187285f0a552b1
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupdge2RUwgy4VSh4:A9iIxuERzA83h09RZxYsY9
MD5 SHA1 SHA512 SSDEEP

Submit Download