85ba8696e84426ee4ec5a20b00d727482df6595dffa90b2d9c35a2c78cd98ce5

Analysis

max time kernel
140s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a528280791d24c95a2515bf2c3625933_JaffaCakes118.html
Size 54KB
Sample240613-mwwfvszbpl
SHA256 85ba8696e84426ee4ec5a20b00d727482df6595dffa90b2d9c35a2c78cd98ce5
MD5 a528280791d24c95a2515bf2c3625933
SHA1 4a5fcd770eec69c043d1620df03c3a95d8e12d6d
SHA512 997ed55b9869bbd7f7c940ea7633e48d2ba9072942b79eeec7069ba347ceb92c0eb5433c2b7b0468d55ec0a5c67a52612736b6f39af414eb3c02ebf8001d4d71
SSDEEP 1536:BPMGXVo1tcTKeQSja83f1I3kXdiJH6tDohgHUjyXiLvzKp:Dlo1tcTKeyEgHm30NLvzKp
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133627494691209097"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1181767204-2009306918-3718769404-1000\{891D137E-F186-4454-B7E1-AA2EAC76DD6D}	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 1936	4872	msedge.exe	108
PID 4872 wrote to memory of 1936	4872	msedge.exe	108
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 1440	4872	msedge.exe	109
PID 4872 wrote to memory of 4516	4872	msedge.exe	110
PID 4872 wrote to memory of 4516	4872	msedge.exe	110
PID 4872 wrote to memory of 4244	4872	msedge.exe	111
PID 4872 wrote to memory of 4244	4872	msedge.exe	111
PID 4872 wrote to memory of 4244	4872	msedge.exe	111
PID 4872 wrote to memory of 4244	4872	msedge.exe	111
PID 4872 wrote to memory of 4244	4872	msedge.exe	111
PID 4872 wrote to memory of 4244	4872	msedge.exe	111
PID 4872 wrote to memory of 4244	4872	msedge.exe	111
PID 4872 wrote to memory of 4244	4872	msedge.exe	111
PID 4872 wrote to memory of 4244	4872	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a528280791d24c95a2515bf2c3625933_JaffaCakes118.html
1⤵
PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=760,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
1⤵
PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=1040,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
1⤵
PID:2276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5284,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
1⤵
PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5320,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
1⤵
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=5480,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
1⤵
PID:2980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffef866ceb8,0x7ffef866cec4,0x7ffef866ced0
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3216,i,16647676142038553896,2369836274664862599,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:2
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1892,i,16647676142038553896,2369836274664862599,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:3
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2180,i,16647676142038553896,2369836274664862599,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4424,i,16647676142038553896,2369836274664862599,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4424,i,16647676142038553896,2369836274664862599,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4528,i,16647676142038553896,2369836274664862599,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4512,i,16647676142038553896,2369836274664862599,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:3784

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"
1⤵
PID:4900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8a9a0936101a40caa1723b113d96c84581c10ca3a9bfba7ac4c687ae4d412dcc
MD5 e2d20b7aaf489fdcc84998ded82e50d0
SHA1 c62b739d5f664d3a9995a0ee9a07d9e0eadec2b0
SHA512 4cb66262eb71b5ad9f6bd4926abbebcfe0058b589b4cb7e6fc5a74e1c5d280b0c32e1c2e66aa2bcb96f15d7c180cc4cc096daba75e79d5da3fac4bebe59bd707
SSDEEP 192:sVwaPIjsyWcCEa37kZ3UHj++hjXqPm610lJ:sV/QjsyWcCJHphC4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b39d5eac2e2ece35a943f5a6b5033c52872497209f50f484f1f170c74c90892a
MD5 ca126fd5fe7393c27266dc19e90d3c54
SHA1 e6aab2b7a67e453d812685d0b55e72bfc23a4886
SHA512 e8b4d147791b100b6e05f1efca558e8eaf3b17a4d643e3da4fbb5b757d4b0d4f089909d48eff64a28466136e2a5318bf944a93587c52a86c5c0964c83a276627
SSDEEP 768:MuhOl0ko5uertb4ZikP2jZth+1mfg334ZsmO/o+d7FJGiuz2:MQ6LsRM/P6y1Yg4ZsXQ+dhJKy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 792a380fb43421c9903b452e8ad3b3b3252c10d18ab3ca3534c736bdd490bccb
MD5 8fcda84aa05b7a4bb99bb61742433d1a
SHA1 5728891fda29180240e66faea95a03be7de5b0af
SHA512 d978c895a653ba022a75596f35d09de206e2e2fd180c85bf64c2fc30acd0038430ac28b4a468e49dc96bf7565461e0908c67a22fc69fb545ee360fea528f6993
SSDEEP 768:6uhOl0ko5uertb4ZikP2jZth+1mfg334ZsmO/o+d7FJGiu5:6Q6LsRM/P6y1Yg4ZsXQ+dhJK5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads