27349da5f5ddc660b821651d4dccd76905524471010451bce396b85a67aee50b

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3d3e73bb4df5c23419f55ca024a0796_JaffaCakes118.html
Size 200KB
Sample240613-e53yasthqc
SHA256 27349da5f5ddc660b821651d4dccd76905524471010451bce396b85a67aee50b
MD5 a3d3e73bb4df5c23419f55ca024a0796
SHA1 394e23b37210f34b7d7825c09891e0b33cf90574
SHA512 167a3777025c3ded9817b35687f059cbe68ab80050588695adc436cd22868869336789e84d41465c4b93b512caa76960fcaaef4a1bd604b2ee23e8b783101e08
SSDEEP 3072:Sb0b2l/QeLbGGAdCHOjRPe+6XQqN2IsT3h0uJqjmtOuxL2uzbGzr0/ovWIF4BhnW:9C7bVyjR56
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1096	msedge.exe
1096	msedge.exe
912	msedge.exe
912	msedge.exe
1584	identity_helper.exe
1584	identity_helper.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 4812	912	msedge.exe	82
PID 912 wrote to memory of 4812	912	msedge.exe	82
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 3296	912	msedge.exe	83
PID 912 wrote to memory of 1096	912	msedge.exe	84
PID 912 wrote to memory of 1096	912	msedge.exe	84
PID 912 wrote to memory of 2068	912	msedge.exe	85
PID 912 wrote to memory of 2068	912	msedge.exe	85
PID 912 wrote to memory of 2068	912	msedge.exe	85
PID 912 wrote to memory of 2068	912	msedge.exe	85
PID 912 wrote to memory of 2068	912	msedge.exe	85
PID 912 wrote to memory of 2068	912	msedge.exe	85
PID 912 wrote to memory of 2068	912	msedge.exe	85
PID 912 wrote to memory of 2068	912	msedge.exe	85
PID 912 wrote to memory of 2068	912	msedge.exe	85
PID 912 wrote to memory of 2068	912	msedge.exe	85
PID 912 wrote to memory of 2068	912	msedge.exe	85
PID 912 wrote to memory of 2068	912	msedge.exe	85
PID 912 wrote to memory of 2068	912	msedge.exe	85
PID 912 wrote to memory of 2068	912	msedge.exe	85
PID 912 wrote to memory of 2068	912	msedge.exe	85
PID 912 wrote to memory of 2068	912	msedge.exe	85
PID 912 wrote to memory of 2068	912	msedge.exe	85
PID 912 wrote to memory of 2068	912	msedge.exe	85
PID 912 wrote to memory of 2068	912	msedge.exe	85
PID 912 wrote to memory of 2068	912	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3d3e73bb4df5c23419f55ca024a0796_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3ad546f8,0x7ffa3ad54708,0x7ffa3ad54718
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2054374664927643695,16695237737875714551,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,2054374664927643695,16695237737875714551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,2054374664927643695,16695237737875714551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2054374664927643695,16695237737875714551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2054374664927643695,16695237737875714551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2054374664927643695,16695237737875714551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2054374664927643695,16695237737875714551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2054374664927643695,16695237737875714551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2054374664927643695,16695237737875714551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2054374664927643695,16695237737875714551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2054374664927643695,16695237737875714551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2054374664927643695,16695237737875714551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2054374664927643695,16695237737875714551,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4628 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 96d12de004b1c44ee3b352652fd434460649cad7925fc4a0d0b75f2362e0a494
MD5 c2bff0224c6b3990d733bc7b8facdff7
SHA1 8054f92b81e074342512a385397f1f4c2db4d3da
SHA512 7b0cba1d96619741b2a24fbd51df31761084a079a1b3462d0f3d2c24df0e198a9353cda61f50502582a8222d192f9acb942f549bc65ef66b21f2eb8f3db240e7
SSDEEP 96:n8kWW1q4juwpvWMoiVmdeHvSS2UWQyV+VDCziEwb:n8k1M4juGWMXcro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 68b5364480b54288a08d502966b6d51cc9f2fd5c4516066350cd74dc5fce284c
MD5 9e02d67ec8198b0ce8c9a2e65d42993c
SHA1 4333b368692ac7230aef1398e290a7cdcb9c2a07
SHA512 f359e69c52465d7cdb995a08b0c7cc26e2765ebb37abfa6ad12e544b3e7bb7f54954f3844a45c0ab363039b56df05ac45ed69262daf9bbfc09824ba7ccc0b5c8
SSDEEP 96:n8kWW1qedjuwpvWMoiVmdeAW4Thl2vSS2UWQyV+VD7AiEwb:n8k1MQjuGWMwW4ll2crg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a385154be3baf6549221a01e8560488811f5d37f1c545956993aa7fed56cb6fd
MD5 07fbff4e8d7ac8ee6721410b98424bcc
SHA1 953f521633e3f4401a5f1fdae15ba3751ebaec65
SHA512 bb20f330d58c9171e256da3d43d50d8e835f19e0d842a1bafb088fd16b9f31053819f991afd35ce5603a782062709adef3aacbdc02257a626e57f4aee9456999
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupi1e2RUQ4up:A9iIxuERzA83h09RZxYixBp
MD5 SHA1 SHA512 SSDEEP

Submit Download