6c6de3c57f7969e2a4dbe24ae33ea19df1fb17e371309ba58976578743354ba8

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a51f167aac4415eea3e896864746a8c7_JaffaCakes118.html
Size 220KB
Sample240613-mp45esvfmg
SHA256 6c6de3c57f7969e2a4dbe24ae33ea19df1fb17e371309ba58976578743354ba8
MD5 a51f167aac4415eea3e896864746a8c7
SHA1 685b8c075496c5dbd1bf77be440aff32b0ec5732
SHA512 1285e7b18e1d0e0b7bccc4a69d976968b95cb4aa016f134bd356819ba60807248e04c77d3e2d62600f232c1ddcd576a8e6cde145294d12d04d3dcf2ffb0fe761
SSDEEP 6144:YDwhChjdSL3cCNRDCvVvkcAfUnE1/rvipugN2xht80q9sqm3q:YDC2A3c9vVvsWExrgN2xht80q9Aq
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
2336	msedge.exe
2336	msedge.exe
4884	identity_helper.exe
4884	identity_helper.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3252	640	msedge.exe	82
PID 640 wrote to memory of 3252	640	msedge.exe	82
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 1236	640	msedge.exe	83
PID 640 wrote to memory of 2336	640	msedge.exe	84
PID 640 wrote to memory of 2336	640	msedge.exe	84
PID 640 wrote to memory of 4868	640	msedge.exe	85
PID 640 wrote to memory of 4868	640	msedge.exe	85
PID 640 wrote to memory of 4868	640	msedge.exe	85
PID 640 wrote to memory of 4868	640	msedge.exe	85
PID 640 wrote to memory of 4868	640	msedge.exe	85
PID 640 wrote to memory of 4868	640	msedge.exe	85
PID 640 wrote to memory of 4868	640	msedge.exe	85
PID 640 wrote to memory of 4868	640	msedge.exe	85
PID 640 wrote to memory of 4868	640	msedge.exe	85
PID 640 wrote to memory of 4868	640	msedge.exe	85
PID 640 wrote to memory of 4868	640	msedge.exe	85
PID 640 wrote to memory of 4868	640	msedge.exe	85
PID 640 wrote to memory of 4868	640	msedge.exe	85
PID 640 wrote to memory of 4868	640	msedge.exe	85
PID 640 wrote to memory of 4868	640	msedge.exe	85
PID 640 wrote to memory of 4868	640	msedge.exe	85
PID 640 wrote to memory of 4868	640	msedge.exe	85
PID 640 wrote to memory of 4868	640	msedge.exe	85
PID 640 wrote to memory of 4868	640	msedge.exe	85
PID 640 wrote to memory of 4868	640	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a51f167aac4415eea3e896864746a8c7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac76d46f8,0x7ffac76d4708,0x7ffac76d4718
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,6147697751644590764,14637993672665967692,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,6147697751644590764,14637993672665967692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,6147697751644590764,14637993672665967692,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6147697751644590764,14637993672665967692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6147697751644590764,14637993672665967692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,6147697751644590764,14637993672665967692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,6147697751644590764,14637993672665967692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6147697751644590764,14637993672665967692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6147697751644590764,14637993672665967692,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6147697751644590764,14637993672665967692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6147697751644590764,14637993672665967692,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,6147697751644590764,14637993672665967692,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
SHA1 86174e670c44767c08a39cc2a53c09c318326201
SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
MD5 b704c9ca0493bd4548ac9c69dc4a4f27
SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 becfe2cc60e10e4a7c4c805d97cb95150a34f284d0dd353599c3fb13257673e5
MD5 4bcf22cf43485d4453b19064b21bade8
SHA1 bacac6e6f9822fbb063ea23c3bdc4191d845bd50
SHA512 a0f76ae627a8e4684ad8476f297ef54af047e2adcec6f4ef746ac040934995f5d27ef3d7cb73a397e47a7bbab314edca19f13aef287ba896f2caad5c10d2cf69
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 cfb95296d1499dedac0a94c77f6795a611e4fda17611e696e541baeb75b9c538
MD5 6f188f2d83192a96b619dd1de0223280
SHA1 7894fdbff08d4069117319c71156f29683ceb119
SHA512 3afa0cf31526f20070cc254d2c0986f4fca07325e09fc1568fab98f1ab57213c7fd27aa554d937719c7b83177ea7151a6a708a720c751e3915dc74ff29ceb1b6
SSDEEP 96:nHkVoxm/DnmqM1ijwpvWMoiVmdes4pe4g22WfMADUWQyV+VDCAiEwb:nHkf6bAjGWMc4pe4g2/rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7d34147ddf4e2631c92b14146467cfb77074ce768e4ff33675412f2edadf21d4
MD5 b66c50fefbbeef271f3bde28961fc3e3
SHA1 6c291b2a57d2514a37bc83f61194a39b0b651b07
SHA512 1356ed5491fc391b75476837b70a3de1e84967c9c4420c4cc3ab522587cc3931a5b70549ae3706554e296a388ff07acaf7e189dac927d2e296f32972cc332fde
SSDEEP 96:nHkVoxm/DQYmqM1ijwpvWMoiVmdeH2WfMADUWQyV+VDCziEwb:nHkfIbAjGWMX/ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3222e273af476805737d9c49caecb105eb9abe13e6f905df6a02c9115f61c401
MD5 716e835bfed21cb6c8775bbe462637b0
SHA1 ca4ada39c5284993744edb2b37b6fa8bf685ff29
SHA512 9d2e0cf64757c55287cb05fe3fb5c3e80dd91a26d4a4936274618a13e1030357e93e6c9195930261e3e0b91ae32b97cccfbeddc96850b3798ab29101c23a9435
SSDEEP 96:nHkVoxm/DnmqM1ijwpvWMoiVmdes4pe4g22WfMADUWQyV+VD7AiEwb:nHkfCbAjGWMc4pe4g2/rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b6a610ce23e38ce8b7113789f3c85412cd9c5b323375712cf5dd982d6612ed6b
MD5 a7aed7874b331270120503ea29bc1588
SHA1 f7a89700fd2bd929e3cb7816c6d6cce2c9cca607
SHA512 fa68d5e0659e15a51f1ecb00507be1c996a798b0384c37a1053a925ff77e803389aa9477ecae082ea76d0d13687262942e86ab7a97abc2bfe67574e136f80358
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupFkHfMe2RULQ/23z2OMDCRv:A9iIxuERzA83h09RZxYcaP2aOMWRHqlS
MD5 SHA1 SHA512 SSDEEP

Submit Download