5ce16d20b521b459c63148d48a86f8eaea1fcdf5d8601f5e464104f39b32666e

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 08:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4a077dc4f3409483185bf0773428df5_JaffaCakes118.html
Size 25KB
Sample240613-kcb7rsvdnn
SHA256 5ce16d20b521b459c63148d48a86f8eaea1fcdf5d8601f5e464104f39b32666e
MD5 a4a077dc4f3409483185bf0773428df5
SHA1 0d5e6b4945f154cae4cbf39de394c12c6d69df45
SHA512 af1e5891539c2e836a3b39f6267165ac098a116ade5e85b8d6d3817a9b99fcaa12efed404606245f6fd0e1d669b00083d0c1e0d95f9ea5c9b946ce04c2c50d92
SSDEEP 192:NI1oXCqub5nxnQjLntQ/inQieEnYnQOkrntkznQTbngnQYYqCWAnpdE4wuXM4nFi:u1oDzQ/r2SCO
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe
4192	msedge.exe
4192	msedge.exe
764	identity_helper.exe
764	identity_helper.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 3004	4192	msedge.exe	81
PID 4192 wrote to memory of 3004	4192	msedge.exe	81
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 1444	4192	msedge.exe	83
PID 4192 wrote to memory of 4668	4192	msedge.exe	84
PID 4192 wrote to memory of 4668	4192	msedge.exe	84
PID 4192 wrote to memory of 4372	4192	msedge.exe	85
PID 4192 wrote to memory of 4372	4192	msedge.exe	85
PID 4192 wrote to memory of 4372	4192	msedge.exe	85
PID 4192 wrote to memory of 4372	4192	msedge.exe	85
PID 4192 wrote to memory of 4372	4192	msedge.exe	85
PID 4192 wrote to memory of 4372	4192	msedge.exe	85
PID 4192 wrote to memory of 4372	4192	msedge.exe	85
PID 4192 wrote to memory of 4372	4192	msedge.exe	85
PID 4192 wrote to memory of 4372	4192	msedge.exe	85
PID 4192 wrote to memory of 4372	4192	msedge.exe	85
PID 4192 wrote to memory of 4372	4192	msedge.exe	85
PID 4192 wrote to memory of 4372	4192	msedge.exe	85
PID 4192 wrote to memory of 4372	4192	msedge.exe	85
PID 4192 wrote to memory of 4372	4192	msedge.exe	85
PID 4192 wrote to memory of 4372	4192	msedge.exe	85
PID 4192 wrote to memory of 4372	4192	msedge.exe	85
PID 4192 wrote to memory of 4372	4192	msedge.exe	85
PID 4192 wrote to memory of 4372	4192	msedge.exe	85
PID 4192 wrote to memory of 4372	4192	msedge.exe	85
PID 4192 wrote to memory of 4372	4192	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4a077dc4f3409483185bf0773428df5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffa405846f8,0x7ffa40584708,0x7ffa40584718
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,7794753016008826223,18301681534681739295,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,7794753016008826223,18301681534681739295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,7794753016008826223,18301681534681739295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7794753016008826223,18301681534681739295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7794753016008826223,18301681534681739295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,7794753016008826223,18301681534681739295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1336 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,7794753016008826223,18301681534681739295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7794753016008826223,18301681534681739295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7794753016008826223,18301681534681739295,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2196 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7794753016008826223,18301681534681739295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7794753016008826223,18301681534681739295,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,7794753016008826223,18301681534681739295,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
SHA1 86174e670c44767c08a39cc2a53c09c318326201
SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
MD5 b704c9ca0493bd4548ac9c69dc4a4f27
SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2845cc5094e9e9cbb968f27a29f0edcbf02f8bf619dda5b259a60d81b0f3bef1
MD5 7324a860c007c5c51d7310e75b0bf327
SHA1 f84544b58162016c00c5534cfb0c240dbc30c468
SHA512 c5faaad6d0016e4818896701d6171ca915eb667569b55a3b22b691583baa1bdffe91eaccaf29bba06834d38d2edef62f2f5f4712dfec5619a08902bfd53889d7
SSDEEP 96:n8kfoxm/DnmqF915JaQwpvWMoiVmdeH2WfvUWQyV+VDCAiEwb:n8kh6c9nJaQGWMXfrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 cc642706545b7deb6e06c73068311a205e4affca8898461ace52bd98af8ebe3b
MD5 afe6f17bc28b0eade21fe72582892738
SHA1 53efabb04ca184ef2d5b47f6c6de60876a72b21d
SHA512 915fb5bfbf9757485f270878e5b9391d4679a853a175bd700a98df031985090b8aaf6aaf66903ca79480f02a0559d8018830196a6ffd22601466c3ac8754aa80
SSDEEP 96:n8kfoxm/DQYmqF915JaQwpvWMoiVmdeH2WfvUWQyV+VDCziEwb:n8khIc9nJaQGWMXfro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 991e4f45a333c265ae6c9797133f806a37caeb49143dd287bccfe6affdb55c05
MD5 8f8199cc9952b491d03a415acaf4dc84
SHA1 37758afd5aa6a266a8361b38feb0884fbb5e094d
SHA512 0270c0e4109c134c12504fbb7c156eeb7d9e2baa5f02398b76bd8de03223419c84706e1c59db3e654f9e2dc38f950f48b293c1a32617f3024d54158fc232d3e9
SSDEEP 96:n8kfoxm/DnmqF915JaSwpvWMoiVmdeH2WfvUWQyV+VDCAiEwb:n8kh6c9nJaSGWMXfrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 bb452b0258df9514eac5bb1e8940fcab45e4da851ebeb395eead124b2ee507f6
MD5 392b1fcd4d7ab21659a8e61b423f0297
SHA1 fac1b98eeb14728e73947808c48a602c90c78f0f
SHA512 787c6ed8f475d44f8a5464af09f6f7105cd9df67585150221fb088773605cf43ebcd5d8e61da5442a03b8cef217570e529c02eca47ba84e5ea02fee670c267b4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupJHfZe2RUlh/S3z2OMDCRHz:A9iIxuERzA83h09RZxYl1OSaOMWRHqle
MD5 SHA1 SHA512 SSDEEP

Submit Download