3dc7f80135327d3efee91a80503f0f0e46046d65cd11644f569600de787222d2

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a55b9d183763121271d26db7035f248a_JaffaCakes118.html
Size 32KB
Sample240613-nv7cea1eqk
SHA256 3dc7f80135327d3efee91a80503f0f0e46046d65cd11644f569600de787222d2
MD5 a55b9d183763121271d26db7035f248a
SHA1 395f144bf27a860a501a0d41fd28d5ebed29b378
SHA512 ea3babb5180d67e1217cea191173f01898cea3ab16c0f4aaa14b7e60986cc7439126ad51969f24998e8dd8a5df7669432606539e2bbe01acff9a5e722386b084
SSDEEP 192:uWfdb5n3WmnQjxn5Q/unQieVNnunQOkEntiQnQTbnxnQPMCyAcYLWPY6NJoky9t5:6nQ/mk86P9NQt3jhOk
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe
1600	msedge.exe
1600	msedge.exe
4684	identity_helper.exe
4684	identity_helper.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 5108	1600	msedge.exe	81
PID 1600 wrote to memory of 5108	1600	msedge.exe	81
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 1496	1600	msedge.exe	82
PID 1600 wrote to memory of 2276	1600	msedge.exe	83
PID 1600 wrote to memory of 2276	1600	msedge.exe	83
PID 1600 wrote to memory of 4032	1600	msedge.exe	84
PID 1600 wrote to memory of 4032	1600	msedge.exe	84
PID 1600 wrote to memory of 4032	1600	msedge.exe	84
PID 1600 wrote to memory of 4032	1600	msedge.exe	84
PID 1600 wrote to memory of 4032	1600	msedge.exe	84
PID 1600 wrote to memory of 4032	1600	msedge.exe	84
PID 1600 wrote to memory of 4032	1600	msedge.exe	84
PID 1600 wrote to memory of 4032	1600	msedge.exe	84
PID 1600 wrote to memory of 4032	1600	msedge.exe	84
PID 1600 wrote to memory of 4032	1600	msedge.exe	84
PID 1600 wrote to memory of 4032	1600	msedge.exe	84
PID 1600 wrote to memory of 4032	1600	msedge.exe	84
PID 1600 wrote to memory of 4032	1600	msedge.exe	84
PID 1600 wrote to memory of 4032	1600	msedge.exe	84
PID 1600 wrote to memory of 4032	1600	msedge.exe	84
PID 1600 wrote to memory of 4032	1600	msedge.exe	84
PID 1600 wrote to memory of 4032	1600	msedge.exe	84
PID 1600 wrote to memory of 4032	1600	msedge.exe	84
PID 1600 wrote to memory of 4032	1600	msedge.exe	84
PID 1600 wrote to memory of 4032	1600	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a55b9d183763121271d26db7035f248a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffaab146f8,0x7fffaab14708,0x7fffaab14718
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,2601438675466836222,5808314499345383086,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,2601438675466836222,5808314499345383086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,2601438675466836222,5808314499345383086,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,2601438675466836222,5808314499345383086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,2601438675466836222,5808314499345383086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,2601438675466836222,5808314499345383086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,2601438675466836222,5808314499345383086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,2601438675466836222,5808314499345383086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,2601438675466836222,5808314499345383086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,2601438675466836222,5808314499345383086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,2601438675466836222,5808314499345383086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1976 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,2601438675466836222,5808314499345383086,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4176 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
MD5 dabfafd78687947a9de64dd5b776d25f
SHA1 16084c74980dbad713f9d332091985808b436dea
SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
MD5 c39b3aa574c0c938c80eb263bb450311
SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c4b3bad010aeee7b229f40add1eeb01461419439d2110a6c5778fb685ec677f9
MD5 899f549c60c0ba15cc9416596382aa49
SHA1 607e272ea32cb2e08484a431c185b84c248eb239
SHA512 6d65e9fc04e5e11558f227f0c9d30bc666cdeca0402d84f64a607e093c4b3268561478455c779da5d1dc269ed4862a00c9dbe1245836f9286e530e8c975217ad
SSDEEP 96:nw+kBoxm/DQYmqAs1fSmwpvWMoiVmdeH1DVozUWQyV+VDCziEwb:nw+krIBsZSmGWMXzozro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b2ef0841d414798f5b79b37c8ad2fce4398418d345a725ee890c3f9c59abc1a1
MD5 7c0bc6e5404a22304e31950523c36317
SHA1 58ea3a4ce66c4e0e2af635ddffdd272112f3c24c
SHA512 d1a42f6d4caf8a343ee17f3149c3f9965841654a5a4c35c06812061dd070353a2bc8b3caaa5674f3694af9c5ab950cb0005c58e54cf744cbb1f85c14d5c349fd
SSDEEP 96:nw+kBoxm/DnmqAs1fSmwpvWMoiVmdeH1DVozUWQyV+VDCAiEwb:nw+kr6BsZSmGWMXzozrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

ff4209ae-aca2-4dab-a5d2-f58f15cede44.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ff4209ae-aca2-4dab-a5d2-f58f15cede44.tmp
Size 6KB
SHA256 dbeaf866a5d9803a53441506b0911fe0b0e0fbe408281a732d5608747a1eb94f
MD5 c1fab3fcdc464a584997639b3a92c77a
SHA1 71aa973276123766ccad7f2cf58754d3bfa399ca
SHA512 64c662f207648c367d3e34fe48e42beb7d567831502a5c02d13978d2f5c40d4887f6ef05a8757bc901764f37fd398a9834a2faa0ed0b2df3136726a77fb14b03
SSDEEP 96:nw+kBoxm/DnmqAs1fXmwpvWMoiVmdeH1DVozUWQyV+VDCAiEwb:nw+kr6BsZXmGWMXzozrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e2890fa7128ca7e858d2cc278c2fb38f2727c23619ce4a55ec04f7e16381d914
MD5 0b4f399dea9d366f6c870e6f0da90c3b
SHA1 01943dd890e7cd39c8d164353ef50ac1ae2642e8
SHA512 e38377ab734b7e05dace784fe8eb287e0977fc923792567dbe6b45dd021c37e73984fb3f90ffb90ff7942ba5c79cb546eeec51d979f871521cab7883637e5fb7
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup9Xie2RUmbvSRsRT3z2OMDU:A9iIxuERzA83h09RZxYBcjbKGRTaOMW5
MD5 SHA1 SHA512 SSDEEP

Submit Download