8047a48bb7ad48b8e7eacb34629f92c954fc025c0c504bbc7f4d7f0a7d8908be

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a52230f0df3c46e8e12d0c4099f7daa5_JaffaCakes118.html
Size 128KB
Sample240613-mr23vazalk
SHA256 8047a48bb7ad48b8e7eacb34629f92c954fc025c0c504bbc7f4d7f0a7d8908be
MD5 a52230f0df3c46e8e12d0c4099f7daa5
SHA1 724e43e3c84a321cccf6df85e51160c8d5d9d8de
SHA512 70b216f4a20574cfa4d5bc66600835eb4a554f2df9695b1ae0bbb30828c440e8850774e614e0156267d41069f9e69d5e6a2700e80e73fabb714e3160477d57df
SSDEEP 3072:TJFRGe3/ToXqbIrqbI5BU13G4k5QhLpOatV12gy8RlQxHCj:TfJ3VIIIq3G4k5QhL8atV/
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3120	msedge.exe
3120	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 2144	3120	msedge.exe	83
PID 3120 wrote to memory of 2144	3120	msedge.exe	83
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 4084	3120	msedge.exe	84
PID 3120 wrote to memory of 3816	3120	msedge.exe	85
PID 3120 wrote to memory of 3816	3120	msedge.exe	85
PID 3120 wrote to memory of 400	3120	msedge.exe	86
PID 3120 wrote to memory of 400	3120	msedge.exe	86
PID 3120 wrote to memory of 400	3120	msedge.exe	86
PID 3120 wrote to memory of 400	3120	msedge.exe	86
PID 3120 wrote to memory of 400	3120	msedge.exe	86
PID 3120 wrote to memory of 400	3120	msedge.exe	86
PID 3120 wrote to memory of 400	3120	msedge.exe	86
PID 3120 wrote to memory of 400	3120	msedge.exe	86
PID 3120 wrote to memory of 400	3120	msedge.exe	86
PID 3120 wrote to memory of 400	3120	msedge.exe	86
PID 3120 wrote to memory of 400	3120	msedge.exe	86
PID 3120 wrote to memory of 400	3120	msedge.exe	86
PID 3120 wrote to memory of 400	3120	msedge.exe	86
PID 3120 wrote to memory of 400	3120	msedge.exe	86
PID 3120 wrote to memory of 400	3120	msedge.exe	86
PID 3120 wrote to memory of 400	3120	msedge.exe	86
PID 3120 wrote to memory of 400	3120	msedge.exe	86
PID 3120 wrote to memory of 400	3120	msedge.exe	86
PID 3120 wrote to memory of 400	3120	msedge.exe	86
PID 3120 wrote to memory of 400	3120	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a52230f0df3c46e8e12d0c4099f7daa5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80afd46f8,0x7ff80afd4708,0x7ff80afd4718
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,17701261330063248730,7778600400735953730,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,17701261330063248730,7778600400735953730,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,17701261330063248730,7778600400735953730,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,17701261330063248730,7778600400735953730,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,17701261330063248730,7778600400735953730,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,17701261330063248730,7778600400735953730,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,17701261330063248730,7778600400735953730,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 82fede13d80fb3b86d4cf53879f4a336ba35cfef357d1fbe9cec21253c0fcc88
MD5 2702cc9918208f721c0e7f013f579a8b
SHA1 b8279f18196d88bc3073e4ef553336b285856cca
SHA512 17f060e7ef0dc2427e7e4e6872a797fa34a30052f5e20147ec635c1c91ee542861c4b641e77a11cad53643ec222cede2c26a8ef7d36e0132c291e5ae860283bc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1019B
SHA256 b731d006f04cccc4bfe84aea2b11dc7159f8540b34cfc0bcaee8f00a24e7a995
MD5 5056e9ab5ed0815d3bf7cd63d8cb52d2
SHA1 8742058946e9f2a0b603e17dd37d8e3fa64994dd
SHA512 e5ed8e4b23158320867c2823d520afdec27afff7ecd0ae134659a8a94731716ac5d729ee2e7bfb83e56b16db817bfe51ab2369483ea506cdfb73709a2366c0a1
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 796604a6eba58f73252f5138ab5fc9ee053234c764fa2b40d48aee526d4c4d6b
MD5 c7dba99b01be702cd1249b839d06d710
SHA1 f7f774efa0cfef114abf1410e88752b2f9e83cfe
SHA512 d87e22fe7676a65f68e60f7a004f8162712aaeb0a2ebad180911fb3eb668932232ea273084ab5cc881bd03c67bb46e65ee82b2b59ee66af574a99b0cfee53069
SSDEEP 96:nXAkVoxm/DQYmqh1RYwpvWMoiVmdeHIqQyQGUWQyV+VDCziEwb:nXAkfI6jYGWMXdXhro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a7193013b1ad411de2eecdd91983c19fe0fddcaff465139671bf2cb6cb81075f
MD5 0f2c16123175ca375446680114a17419
SHA1 baca52e233a10875cbb871b8c6b63feb63c43b23
SHA512 fd84295023f10854043a7c02de08dae7fa3cf1539f5df19bc3bd7c71b03431ebca98adab1d3a90db180724124d4615f704b71b08f28b5dab6c65e59aa2293999
SSDEEP 96:nXAkVoxm/Dnmqh1R+wpvWMoiVmdeJ+2IqVyQGUWQyV+VDCAiEwb:nXAkf66j+GWMZ+2dYhrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 31a7032e969269221b57b8e0e2ecd3957bc8b1901858469a8f642d8a9b151633
MD5 d1abe10eed29888616a1e078f70086d5
SHA1 9511cd6a57ad473e8f7bd70585f4133dfad5ca02
SHA512 c2cf2cc6f1bacb600fbd9ca1cb2042ec376da09ad84d92a76e74acbecd319c42325ee92eb39fb41bf48734fd67c4903a06fd603fdb849e742aab4493c6b3b45c
SSDEEP 96:nXAkVoxm/Dnmqh1RYwpvWMoiVmdeJ+2IqQyQGUWQyV+VDCAiEwb:nXAkf66jYGWMZ+2dXhrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 951d94009fb0e5449f0bdb8d9e7097fd083f055c2835e236affec7ec4fb0d796
MD5 11a0b87bae4bfa37fd24e125b5a3b2e9
SHA1 ff7e937ddb1e357f510528d3975c8874453c571d
SHA512 00f668950fc0534667f89361c966209e8955104ceee7b26f551661f5b23b392f35ac6cf75122e17b29de948555885feb2b448e3ba51894f4fbdf31ecd439c7b4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupUp0ue2RUkdvz3z2OMDCRHu:A9iIxuERzA83h09RZxYDwPzaOMWRHql7
MD5 SHA1 SHA512 SSDEEP

Submit Download