a6410ae5b1eba40c79bccc22087ecd242327898427dc9a22693a75b30079a1d4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 06:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a424f4039c9d593d2f06ae123fc87a33_JaffaCakes118.html
Size 69KB
Sample240613-gylrjsxaqa
SHA256 a6410ae5b1eba40c79bccc22087ecd242327898427dc9a22693a75b30079a1d4
MD5 a424f4039c9d593d2f06ae123fc87a33
SHA1 519b8b930ae706b0234303514c5379a16bf5f394
SHA512 b651373e618f86566da9e00f65b6db5ddb4227a99f6a945909a917536cbee0ac153ed7b9ffbfaf17c4048867b873656252f325b64fd3be594ebeaef09a26284c
SSDEEP 1536:bOLayx82XAdzeox/nhebdujpxZhfVDa1OBC:bOeyKx/nhebdujpxZhfVm1Og
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
3616	msedge.exe
3616	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 1960	3616	msedge.exe	82
PID 3616 wrote to memory of 1960	3616	msedge.exe	82
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 1104	3616	msedge.exe	83
PID 3616 wrote to memory of 4908	3616	msedge.exe	84
PID 3616 wrote to memory of 4908	3616	msedge.exe	84
PID 3616 wrote to memory of 5052	3616	msedge.exe	85
PID 3616 wrote to memory of 5052	3616	msedge.exe	85
PID 3616 wrote to memory of 5052	3616	msedge.exe	85
PID 3616 wrote to memory of 5052	3616	msedge.exe	85
PID 3616 wrote to memory of 5052	3616	msedge.exe	85
PID 3616 wrote to memory of 5052	3616	msedge.exe	85
PID 3616 wrote to memory of 5052	3616	msedge.exe	85
PID 3616 wrote to memory of 5052	3616	msedge.exe	85
PID 3616 wrote to memory of 5052	3616	msedge.exe	85
PID 3616 wrote to memory of 5052	3616	msedge.exe	85
PID 3616 wrote to memory of 5052	3616	msedge.exe	85
PID 3616 wrote to memory of 5052	3616	msedge.exe	85
PID 3616 wrote to memory of 5052	3616	msedge.exe	85
PID 3616 wrote to memory of 5052	3616	msedge.exe	85
PID 3616 wrote to memory of 5052	3616	msedge.exe	85
PID 3616 wrote to memory of 5052	3616	msedge.exe	85
PID 3616 wrote to memory of 5052	3616	msedge.exe	85
PID 3616 wrote to memory of 5052	3616	msedge.exe	85
PID 3616 wrote to memory of 5052	3616	msedge.exe	85
PID 3616 wrote to memory of 5052	3616	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a424f4039c9d593d2f06ae123fc87a33_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8aaa946f8,0x7ff8aaa94708,0x7ff8aaa94718
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16781283949891098651,6341775824132865525,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16781283949891098651,6341775824132865525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16781283949891098651,6341775824132865525,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16781283949891098651,6341775824132865525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16781283949891098651,6341775824132865525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16781283949891098651,6341775824132865525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2808 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16781283949891098651,6341775824132865525,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
MD5 SHA1 SHA512

Submit Download

6aebee24-2c0d-4313-bf7a-f92f5e1b4d91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6aebee24-2c0d-4313-bf7a-f92f5e1b4d91.tmp
Size 6KB
SHA256 7292ed8a74748604f21feaef4500929214adf09890402ba551efcbf4bf00d701
MD5 6d58aabf6eb68a6490f2ce22fbb583aa
SHA1 789805fd6f1b4366dfcc0aa357887917020d7633
SHA512 dee4cf8c4ed64785d3e4855793ed7869a91df74ba6d7b160b887a2a698f04ffc200be3971ee3ccaae78c3884b10f00d4e3742ea0192913c4d12eb0c2f0007487
SSDEEP 96:nSk/oxm/DQYmqm1fyswpvWMoiVmdeHIqQp5mVq+UWQyV+VDCziEwb:nSkBI1NysGWMXd0UVq+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 03d52a7064b50b1be841ec9a0994b6953fc3c0962729e078bf0353dc2e571666
MD5 5e41f1d3afe8e517612e5d25fb119531
SHA1 185f4ac261754c47270346fa1efc16e939710e94
SHA512 a7441093961beb887551be741ef22070d282e456a5f8da7d8ccc00b0c75d0f2d5af393f23cde3fcfbf206d7ea7195f128446c777a6f992c17a396e71324b312b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 186B
SHA256 9d9e3fffc28f0c127ed8a126eeb43e83354187191c122b5edf1aaef199bee803
MD5 328d5de52ea27649b98ebdf5ba93a4ad
SHA1 c2d3275d781d958b6a4d9dda2fc5f2e3e20aad7b
SHA512 a9692cb878a04bde2fcc67846e34c7f2fdb6ae98931411de5f54cb0fae3c0c1ba142b80fbe15332cf0e38a8b8a02a33983fee96a6c10165b8d44350c032e6ed1
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f46945df3be1bf060ec993f56fe1d0f3141281995846a02d41b8311907a63fb0
MD5 3f04c254273a11a89e672048bc2d9df4
SHA1 7f9c08331d7709e755c1944795133459dd35cdb0
SHA512 f5d85fdf7b55ec9f27ab3031a2450c0e957aace92ed4d3a3a32d310fc9d2385d5548cc1f70d24a6f25b556fc262010a2800be59b98d5eb406572178e77ed187a
SSDEEP 96:nSk/oxm/Dnmqm1fykwpvWMoiVmdeD09K0qIq1p5mVq+UWQyV+VDCAiEwb:nSkB61NykGWMT09K0qdPUVq+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fcb536a3ea7a121d8667b1ec24025b4b6097877f4d614dfe0c78db582965f8cb
MD5 9592775fab4f0bb2a0f3d2d62c5d3e9c
SHA1 81bc281197e84588790f896cc354512978c03d53
SHA512 a86c6a1278361e6be92bc8c32da7105a57d59c8b45bb9b31dc1a0be09689c4d754cfa999d375a96595fe35e33ba11a4b953ff780bc043a8f8a42ca5d4ff76040
SSDEEP 96:nSk/oxm/Dnmqm1fyswpvWMoiVmdeHIqQp5mVq+UWQyV+VDCAiEwb:nSkB61NysGWMXd0UVq+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 07e9d3aea74858c113451cc7ccefd19c23b87d81ddbb2cb253dde47f5c8d5ccc
MD5 508e753a945bead46d622db382193a68
SHA1 4f17a13bbf91062ee1c4c3578a9c9e90c23210e9
SHA512 73dfc1373e158b554962cf59c662e8ee3b9a106b551915af1711a78974bcfe286ff096300b2821267d8b6ca693a68be8e16793d718f58e8d983441d24f6ed77e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupyp07e2RUldvD3z2OMDCRHi:A9iIxuERzA83h09RZxYVroDaOMWRHqln
MD5 SHA1 SHA512 SSDEEP

Submit Download