33f50162ff2b54ad3553ea9092bc99c08d0aaf1fef15d1762797641d085dd890

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3d00cba93dd61a4590d3e4299e5a06a_JaffaCakes118.html
Size 23KB
Sample240613-e1nyksxfqq
SHA256 33f50162ff2b54ad3553ea9092bc99c08d0aaf1fef15d1762797641d085dd890
MD5 a3d00cba93dd61a4590d3e4299e5a06a
SHA1 156ab6699e54648b4f76d03aec107976228d80b3
SHA512 774533432d50f9ed95a813ea64921be6ecd7a347c700679eb71f0e77d9e855371b5212796c988ed981a218826da5f866f72d900490302fbf56a8ab76142b4095
SSDEEP 192:uWD0b5nX6nQjxn5Q/enQieVNninQOkEntGQnQTbntnQPCnQtpwMB1qnYnQ7tnMYm:6Q/yrxb
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
2980	msedge.exe
2980	msedge.exe
3952	identity_helper.exe
3952	identity_helper.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 424	2980	msedge.exe	84
PID 2980 wrote to memory of 424	2980	msedge.exe	84
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 692	2980	msedge.exe	85
PID 2980 wrote to memory of 1640	2980	msedge.exe	86
PID 2980 wrote to memory of 1640	2980	msedge.exe	86
PID 2980 wrote to memory of 3080	2980	msedge.exe	87
PID 2980 wrote to memory of 3080	2980	msedge.exe	87
PID 2980 wrote to memory of 3080	2980	msedge.exe	87
PID 2980 wrote to memory of 3080	2980	msedge.exe	87
PID 2980 wrote to memory of 3080	2980	msedge.exe	87
PID 2980 wrote to memory of 3080	2980	msedge.exe	87
PID 2980 wrote to memory of 3080	2980	msedge.exe	87
PID 2980 wrote to memory of 3080	2980	msedge.exe	87
PID 2980 wrote to memory of 3080	2980	msedge.exe	87
PID 2980 wrote to memory of 3080	2980	msedge.exe	87
PID 2980 wrote to memory of 3080	2980	msedge.exe	87
PID 2980 wrote to memory of 3080	2980	msedge.exe	87
PID 2980 wrote to memory of 3080	2980	msedge.exe	87
PID 2980 wrote to memory of 3080	2980	msedge.exe	87
PID 2980 wrote to memory of 3080	2980	msedge.exe	87
PID 2980 wrote to memory of 3080	2980	msedge.exe	87
PID 2980 wrote to memory of 3080	2980	msedge.exe	87
PID 2980 wrote to memory of 3080	2980	msedge.exe	87
PID 2980 wrote to memory of 3080	2980	msedge.exe	87
PID 2980 wrote to memory of 3080	2980	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3d00cba93dd61a4590d3e4299e5a06a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe857546f8,0x7ffe85754708,0x7ffe85754718
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3827334915865346700,11297953230631650161,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,3827334915865346700,11297953230631650161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,3827334915865346700,11297953230631650161,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3827334915865346700,11297953230631650161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3827334915865346700,11297953230631650161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3827334915865346700,11297953230631650161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3827334915865346700,11297953230631650161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3827334915865346700,11297953230631650161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3827334915865346700,11297953230631650161,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3827334915865346700,11297953230631650161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3827334915865346700,11297953230631650161,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3827334915865346700,11297953230631650161,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 acc178972eed0f28164d925ac35718545f408efb8325bcd4a96aba06b39a56c2
MD5 9203f9880373297d56f7564b701e92ea
SHA1 3a1d58a9a00368519372ff69a5a72f92d6f03b8b
SHA512 94d10ab1399f6cae8c7699c9edf4f3fa77dddfc4fda8a005c0c69602cdf80dda47f7f673f595c757b1ec3723fe354fc0d1730ac57cd3b2dcf4c9906b329e597d
SSDEEP 96:n4kboxm/DQYmqc13jcwwpvWMoiVmdeHIqQbytUWQyV+VDCziEwb:n4k9I7hwwGWMXdeytro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 761459cb0c35bc1a667b0fe72d8d0b3fc428ef071735df36980229c303e7c2f5
MD5 3239ccbabb90a046afbc249f350c1d8d
SHA1 bd720e2fbdbb7f6751dd14a6d3c3d341ede9d12a
SHA512 3445a69eeedd74fade4a600f167e1ebc3d2be475c7636722b5b45ab30f007ec509cc337ec653bd3b255dcf49121de6b1864ab856231b47db70cb91d70152b50a
SSDEEP 96:n4kVoxm/Dnmqc13jcGwpvWMoiVmdeHIqQbytUWQyV+VDCAiEwb:n4kf67hwGGWMXdeytrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2fe50bd5226857c1755d0d5f5dc283dbb694caadee732baa269a6aa4a509a0c0
MD5 8e2e0c02fdda5facbca5287ec3d40ad4
SHA1 2db950316a1b059799602dd8256824fbe5fef139
SHA512 7235ee08954dcdd6812bfd9e2379203267dd1aea5dcf16ac4e0ab6560cd3f65110f6e72ff6dc99840145b83cffd2f852c3ffd8d2625e988f742f1b2a2ddfd68f
SSDEEP 96:n4kVoxm/Dnmqc13jcwwpvWMoiVmdeHIqQbytUWQyV+VDCAiEwb:n4kf67hwwGWMXdeytrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4c7795eb0b04dede69e75b245e087c47362d09da216ce00634fc7c84e2a9c405
MD5 aefa17a9820a329ccc14f64e13e254b5
SHA1 a1fb5c95c86aad2c80d32f75abed80d0ed6568e4
SHA512 8f57fb6b1de1751fa4f7a2ce1b01b047d1c454daf10666f6cb5f688907e58cbab2e844e1c1131f86f744201a1d1b10a0d3084c89619f894ee0655c2ab9aa586c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupqhp0Ve2RUodvt3z2OMDCRO:A9iIxuERzA83h09RZxYqURftaOMWRHqZ
MD5 SHA1 SHA512 SSDEEP

Submit Download