8384e5e547eaeb11b99db13c4351a7167dea70d5720c5399d1a5d50bf98378c0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4a59b6e35205ad40a9929b0d0687e6c_JaffaCakes118.html
Size 33KB
Sample240613-kfgxes1dqd
SHA256 8384e5e547eaeb11b99db13c4351a7167dea70d5720c5399d1a5d50bf98378c0
MD5 a4a59b6e35205ad40a9929b0d0687e6c
SHA1 9cf2a9bd4a1730bf80c0adcc8af2656ed5eb1e00
SHA512 63ee0dd289cb3c20398463a9e36c5bd9ee39c76958c78274a25283f98d4adaf2c52c4f9a30701c2588fbe183afd5ec7d5b3908bfc61613aed6cc5a8c81239f24
SSDEEP 768:S25PILtdQg+LPLdlowXWALBXDfNO6L+7N1S1E8dZ8uM:S25QLAdLPLXowXWALBXDfNO6L+7No1Hq
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
828	msedge.exe
828	msedge.exe
2844	identity_helper.exe
2844	identity_helper.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 4268	828	msedge.exe	82
PID 828 wrote to memory of 4268	828	msedge.exe	82
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 4828	828	msedge.exe	83
PID 828 wrote to memory of 1492	828	msedge.exe	84
PID 828 wrote to memory of 1492	828	msedge.exe	84
PID 828 wrote to memory of 2280	828	msedge.exe	85
PID 828 wrote to memory of 2280	828	msedge.exe	85
PID 828 wrote to memory of 2280	828	msedge.exe	85
PID 828 wrote to memory of 2280	828	msedge.exe	85
PID 828 wrote to memory of 2280	828	msedge.exe	85
PID 828 wrote to memory of 2280	828	msedge.exe	85
PID 828 wrote to memory of 2280	828	msedge.exe	85
PID 828 wrote to memory of 2280	828	msedge.exe	85
PID 828 wrote to memory of 2280	828	msedge.exe	85
PID 828 wrote to memory of 2280	828	msedge.exe	85
PID 828 wrote to memory of 2280	828	msedge.exe	85
PID 828 wrote to memory of 2280	828	msedge.exe	85
PID 828 wrote to memory of 2280	828	msedge.exe	85
PID 828 wrote to memory of 2280	828	msedge.exe	85
PID 828 wrote to memory of 2280	828	msedge.exe	85
PID 828 wrote to memory of 2280	828	msedge.exe	85
PID 828 wrote to memory of 2280	828	msedge.exe	85
PID 828 wrote to memory of 2280	828	msedge.exe	85
PID 828 wrote to memory of 2280	828	msedge.exe	85
PID 828 wrote to memory of 2280	828	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4a59b6e35205ad40a9929b0d0687e6c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb750746f8,0x7ffb75074708,0x7ffb75074718
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,12342829898892796581,5966115183112607576,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,12342829898892796581,5966115183112607576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,12342829898892796581,5966115183112607576,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12342829898892796581,5966115183112607576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12342829898892796581,5966115183112607576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12342829898892796581,5966115183112607576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,12342829898892796581,5966115183112607576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,12342829898892796581,5966115183112607576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12342829898892796581,5966115183112607576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12342829898892796581,5966115183112607576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12342829898892796581,5966115183112607576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12342829898892796581,5966115183112607576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,12342829898892796581,5966115183112607576,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b1f4f07957e0a6bdeb9de1cb183999d6d090145943ce63ec985e2eeca159ed02
MD5 c31475790f73eb1c683dda39b16ef4ef
SHA1 033d1132e9af5c21f18d393b2272b1ac0afd0ccd
SHA512 ce683da49175f8a50bf49c7e6b7898dbf70b98db07825fd2771228a4368e83193a7d11ecb3a3910a387ba7aed9135fc3123c2e94dfb3ca1545b4f8733f2c6fe9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 644B
SHA256 8bd4a5e6d5b627754085921a05eeb340d4027266a62e2cf7abc2bec89ce725bb
MD5 7fda204c5163d0910c0ddd8fbe0f39c5
SHA1 dfce4e37122def12ca44ffb120eb26a5447aa4a9
SHA512 845ceb62debfc78057ccdddaf41164ffd5edeb36049119b47cb71b1043e8bab795e423f5fa9902d4ca1b90a6e567e85bb508861b7728a32348e692f1d38038fc
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 495b31e2623cf6af816141c02478146e466ceadb7f3ee451702990a05b7ccf71
MD5 3f5ac6eccd563e339361e40659c5055d
SHA1 4025ad2ffbdc7a1956424db4af8982c6bfa535a5
SHA512 01f2b7edae31662d66c97bfe8d918aa9e7d06840cf02a4f11ea970481b216ffa686f82c614f5c0adfb5ad21500cba33a4e57f0b39f64cb2b0d4125f501623800
SSDEEP 96:npk7oxm/DsmqF1LewpvWMoiVmdeMeVi2IqQq8UWQyV+VD7AiEwb:npkd7qJeGWM8eVi2df8rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7b0f8d5ba6a7c881c610ef9a2089e1045d64bb63d05f68e7fa768aeb8374a8cd
MD5 8be1da07c461a6bac21c8a4a7bea6c9a
SHA1 7110599af6f66752cd749649bfa0b596ff82206e
SHA512 4a954c007bb3ea57a29af11375737e0b9187a221672e494acda2b9e30a97463f898b2cd83b0ce8832f8e74b3efa378a66d4325dfae87834a7485d9e0da63d5d1
SSDEEP 96:npk7oxm/DQYmqF1L4wpvWMoiVmdeHIqQq8UWQyV+VDCziEwb:npkdIqJ4GWMXdf8ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 fd6cf237c6515aca3b17593a7400d294a68aa3f2a898f769528f3e73bcb61336
MD5 a42648f5f62e2f1c1ac5d74db7a2d799
SHA1 fa86d79d4dc4341479068cfebc30f6125c693a75
SHA512 92ac18af3c00f50726551a6356cb70de27f5f20151c1e3b16d00646e22a323d4dbd177dd1c7f16185514e35a46404e8f808a7b37bccfae18ad602ba97298f733
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupWp0+e2RUFdv23z2OMDCRHf:A9iIxuERzA83h09RZxYRgk2aOMWRHqlK
MD5 SHA1 SHA512 SSDEEP

Submit Download