60790dc5cee99c8e9d78104f25d8d20d5fe5fa9ef1ccd633452f014aa16557da

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 15:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a62e630a2cd9c5b19670ac7c13c1fe03_JaffaCakes118.html
Size 55KB
Sample240613-sjhbcstfkd
SHA256 60790dc5cee99c8e9d78104f25d8d20d5fe5fa9ef1ccd633452f014aa16557da
MD5 a62e630a2cd9c5b19670ac7c13c1fe03
SHA1 d40b883cf8536ccd87c33e47aee66ba3aeccb9e0
SHA512 409098889b2ac89378e8b5ad4690f28969dbbf542583f8e9c21630bd1e6e75cc21c6f51fd50a314fecf08d42e3a9f05a9f45b04e44a5cd12c4c3f8d570d6e264
SSDEEP 1536:9LxHv7o+33MwfQU4HKR3aVZkrWmDeJ6pVmDVM:jHT3MmFrNDeJ6pVV
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1096	msedge.exe
1096	msedge.exe
1872	msedge.exe
1872	msedge.exe
544	identity_helper.exe
544	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1444	1872	msedge.exe	82
PID 1872 wrote to memory of 1444	1872	msedge.exe	82
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1684	1872	msedge.exe	83
PID 1872 wrote to memory of 1096	1872	msedge.exe	84
PID 1872 wrote to memory of 1096	1872	msedge.exe	84
PID 1872 wrote to memory of 2928	1872	msedge.exe	85
PID 1872 wrote to memory of 2928	1872	msedge.exe	85
PID 1872 wrote to memory of 2928	1872	msedge.exe	85
PID 1872 wrote to memory of 2928	1872	msedge.exe	85
PID 1872 wrote to memory of 2928	1872	msedge.exe	85
PID 1872 wrote to memory of 2928	1872	msedge.exe	85
PID 1872 wrote to memory of 2928	1872	msedge.exe	85
PID 1872 wrote to memory of 2928	1872	msedge.exe	85
PID 1872 wrote to memory of 2928	1872	msedge.exe	85
PID 1872 wrote to memory of 2928	1872	msedge.exe	85
PID 1872 wrote to memory of 2928	1872	msedge.exe	85
PID 1872 wrote to memory of 2928	1872	msedge.exe	85
PID 1872 wrote to memory of 2928	1872	msedge.exe	85
PID 1872 wrote to memory of 2928	1872	msedge.exe	85
PID 1872 wrote to memory of 2928	1872	msedge.exe	85
PID 1872 wrote to memory of 2928	1872	msedge.exe	85
PID 1872 wrote to memory of 2928	1872	msedge.exe	85
PID 1872 wrote to memory of 2928	1872	msedge.exe	85
PID 1872 wrote to memory of 2928	1872	msedge.exe	85
PID 1872 wrote to memory of 2928	1872	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a62e630a2cd9c5b19670ac7c13c1fe03_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3ad546f8,0x7ffa3ad54708,0x7ffa3ad54718
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3949737170095366679,11973844002786847367,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,3949737170095366679,11973844002786847367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,3949737170095366679,11973844002786847367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3949737170095366679,11973844002786847367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3949737170095366679,11973844002786847367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3949737170095366679,11973844002786847367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3949737170095366679,11973844002786847367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3949737170095366679,11973844002786847367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3949737170095366679,11973844002786847367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3949737170095366679,11973844002786847367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3949737170095366679,11973844002786847367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3949737170095366679,11973844002786847367,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  PID:3116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 afa7d60d30fbab5150cc8c3f73ce4ae56960661ed6a8b65a3bebb8839dcc01f6
MD5 c4365afc26860696f090a0a51614b577
SHA1 01175cb0617dd4cab46f27d5916e3a519d078c43
SHA512 46079417fa2353e59fadf7474628a57d08d0380e212458e12cc41f7156fcc5513354664e2ce8a4d19253ba36bcc89471ffd5c5b7ada9aae97676c6d264ad3e20
SSDEEP 96:nKAkWP1N4juwpvWMoiVmdeHvSSgUWQyV+VDCziEwb:nKAkoX4juGWMX+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1e0bac2d6b990ac88b5a087fec3c33c94c774e47792561e2527b46105ce4b715
MD5 1a2a8478c8fdda476da3c0f564cdd790
SHA1 40a24be04beab5e8a8a2086fb15b3165e1c585d2
SHA512 e134ef8013fd60ddb949e710a53bdbf04122a0dd45cc079c47e8fcdf8e2de9fe2ba158e769bbed2f64d95c45a05404baf4036c697d5963b53d605db38fc4ef57
SSDEEP 96:nKAkWP1NajuwpvWMoiVmdeNr/2Z2vSSgUWQyV+VD7AiEwb:nKAkoXajuGWMdD2Z2+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6be06c86d92f9914d51aa68af40622d927676f5f0c21455a6278ec2b42e95c52
MD5 bd5f88d97dc946fbd68a448d9a702b18
SHA1 92e3cb1c4ea82c17860fa3c3bf190c74755f9572
SHA512 cfe2465060365fb7cf08f82bcd6b2baaacf72bbf4570126792b0398d970cd778dd120d2d7daac73d4e361da33b8776a32347e60f18b7d69d634160ab837feb4a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupiIe2RUy4uC:A9iIxuERzA83h09RZxYimzC
MD5 SHA1 SHA512 SSDEEP

Submit Download