54103a3e515c274b5a5cab19b38e8340978c408bcebf90522342283b34293d17

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 06:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a42f4376180b5784727399f44c6d5d79_JaffaCakes118.html
Size 3KB
Sample240613-g5vm2axcpe
SHA256 54103a3e515c274b5a5cab19b38e8340978c408bcebf90522342283b34293d17
MD5 a42f4376180b5784727399f44c6d5d79
SHA1 5c707b3ed5b4cb3fc2b646b4eb66fa054e5fadc0
SHA512 e8418e8dddc9f6fc217dfd0919a655f81cbd81e3b3a150e991dc550f326e5272137852d214f6c990cde456149232b57602f096a143649d6d2def34d78d232d30
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
2416	msedge.exe
2416	msedge.exe
316	identity_helper.exe
316	identity_helper.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 3620	2416	msedge.exe	86
PID 2416 wrote to memory of 3620	2416	msedge.exe	86
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	87
PID 2416 wrote to memory of 4272	2416	msedge.exe	88
PID 2416 wrote to memory of 4272	2416	msedge.exe	88
PID 2416 wrote to memory of 1152	2416	msedge.exe	89
PID 2416 wrote to memory of 1152	2416	msedge.exe	89
PID 2416 wrote to memory of 1152	2416	msedge.exe	89
PID 2416 wrote to memory of 1152	2416	msedge.exe	89
PID 2416 wrote to memory of 1152	2416	msedge.exe	89
PID 2416 wrote to memory of 1152	2416	msedge.exe	89
PID 2416 wrote to memory of 1152	2416	msedge.exe	89
PID 2416 wrote to memory of 1152	2416	msedge.exe	89
PID 2416 wrote to memory of 1152	2416	msedge.exe	89
PID 2416 wrote to memory of 1152	2416	msedge.exe	89
PID 2416 wrote to memory of 1152	2416	msedge.exe	89
PID 2416 wrote to memory of 1152	2416	msedge.exe	89
PID 2416 wrote to memory of 1152	2416	msedge.exe	89
PID 2416 wrote to memory of 1152	2416	msedge.exe	89
PID 2416 wrote to memory of 1152	2416	msedge.exe	89
PID 2416 wrote to memory of 1152	2416	msedge.exe	89
PID 2416 wrote to memory of 1152	2416	msedge.exe	89
PID 2416 wrote to memory of 1152	2416	msedge.exe	89
PID 2416 wrote to memory of 1152	2416	msedge.exe	89
PID 2416 wrote to memory of 1152	2416	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a42f4376180b5784727399f44c6d5d79_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b7446f8,0x7ff82b744708,0x7ff82b744718
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,3382479710351085289,2956215323422989347,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,3382479710351085289,2956215323422989347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,3382479710351085289,2956215323422989347,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3382479710351085289,2956215323422989347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3382479710351085289,2956215323422989347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,3382479710351085289,2956215323422989347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,3382479710351085289,2956215323422989347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3382479710351085289,2956215323422989347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3382479710351085289,2956215323422989347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3382479710351085289,2956215323422989347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3382479710351085289,2956215323422989347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,3382479710351085289,2956215323422989347,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
MD5 c5abc082d9d9307e797b7e89a2f755f4
SHA1 54c442690a8727f1d3453b6452198d3ec4ec13df
SHA512 ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
MD5 b4a74bc775caf3de7fc9cde3c30ce482
SHA1 c6ed3161390e5493f71182a6cb98d51c9063775d
SHA512 55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 276B
SHA256 02bd271fbf1d8f8cfeb229ec24d7bfb1c261116853c2e66a3f5d0b3536f59a25
MD5 63e94862b42530f86676ad4d8dad984d
SHA1 3fd2230f79711e641c7d8bc1fc8f6d671319aec8
SHA512 8f57ba1d96f3a97a7867f7eb43efd22baea3a78766fd88e87affcbc1e2e1699de833cbe9d78d22fa784ebf9602bd2006ee315ea13aebbcb79b56ec137c7a5aff
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f6208d073b39ef229c98282eeb6af81b0c17efab36c9b04b17989df2bc1d2f7c
MD5 7095ce83561f3e16874425dd9d695768
SHA1 459a5a4c1d9cd600bdf9dccd4ebe7588eb0eff67
SHA512 bc8c98055470a9c426a76a43115d07c28dd04acf61545c8ebf87a67cdf0158d1238e4ab4d38e1ea63c553ee0b824970e522974eb3d99fbaa51d929cdf558bef2
SSDEEP 96:nOkBoxm/Dnmq2R1+UeEcwpvWMoiVmdeEdqnaRcUWQyV+VD7AiEwb:nOkr6nwUebGWMmqOcrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2ce0bd5ea73ae4343a850c8ef93aee74b99dae3e2adb3de4352d0770117f739b
MD5 7b78ae73eb86bde6424dec3694c01d5b
SHA1 43f563b73cb0c6fc4607ee24cbf4142e496047e4
SHA512 858fe6e15ed6c6475b87f48dfb0ff615d2145f1ef2b465d8d4cd7eddbfba0a36d4829772e53953fd3ec3eedc6a400a27a3bdc3916fc48d57fd8b851a2da66b8b
SSDEEP 96:nOkBoxm/DQYmq2R1+UeEcwpvWMoiVmdeHnaRcUWQyV+VD7ziEwb:nOkrInwUebGWMXOcrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f4a9ae24907d5db8e832a16404d04f9e8191cac632937d5b175d4a25c1a47972
MD5 713b36b69ff19ab7e8a66156ed9dca30
SHA1 a8668dbfff5f5cfb0efac564444996bdd2702e76
SHA512 f82d8c2a39a0d8f712e1705057730665a41085b978a86cc506a61772e430158f7b77623580f8ef083cdbd57fe801045f0a46729e393d85b4e774a1cb1078c0f3
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupnSde2RUQUt+3z2OMDCRHqU:A9iIxuERzA83h09RZxYS5W+aOMWRHqlq
MD5 SHA1 SHA512 SSDEEP

Submit Download