10173d9519e10e27e5036af317a107d5e1c1e3b583772351b9b42aff0d5d8304

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a638044904b5232c7085d14d0c366f24_JaffaCakes118.html
Size 104KB
Sample240613-spt74stgrh
SHA256 10173d9519e10e27e5036af317a107d5e1c1e3b583772351b9b42aff0d5d8304
MD5 a638044904b5232c7085d14d0c366f24
SHA1 8eea3197cfcfe5e4645407df8b7bfac723914504
SHA512 236f0600cbd7707bfec1c611df213beb8b0bfe1cebb9cdc92415c8c49d3c0d0f36a6becee0179f331f802008f3ed439d1e5b4edd5a41977b387d993e69299ebe
SSDEEP 1536:3PNkGgHmK7Cl8ooFDn3KuqkGYy5ddfP7p+rspf6cJDAJWZCde8/4q/y+XiiSh:3FVgSfcnW
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
4548	msedge.exe
4548	msedge.exe
4892	identity_helper.exe
4892	identity_helper.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 2284	4548	msedge.exe	81
PID 4548 wrote to memory of 2284	4548	msedge.exe	81
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 2304	4548	msedge.exe	82
PID 4548 wrote to memory of 5088	4548	msedge.exe	83
PID 4548 wrote to memory of 5088	4548	msedge.exe	83
PID 4548 wrote to memory of 4584	4548	msedge.exe	84
PID 4548 wrote to memory of 4584	4548	msedge.exe	84
PID 4548 wrote to memory of 4584	4548	msedge.exe	84
PID 4548 wrote to memory of 4584	4548	msedge.exe	84
PID 4548 wrote to memory of 4584	4548	msedge.exe	84
PID 4548 wrote to memory of 4584	4548	msedge.exe	84
PID 4548 wrote to memory of 4584	4548	msedge.exe	84
PID 4548 wrote to memory of 4584	4548	msedge.exe	84
PID 4548 wrote to memory of 4584	4548	msedge.exe	84
PID 4548 wrote to memory of 4584	4548	msedge.exe	84
PID 4548 wrote to memory of 4584	4548	msedge.exe	84
PID 4548 wrote to memory of 4584	4548	msedge.exe	84
PID 4548 wrote to memory of 4584	4548	msedge.exe	84
PID 4548 wrote to memory of 4584	4548	msedge.exe	84
PID 4548 wrote to memory of 4584	4548	msedge.exe	84
PID 4548 wrote to memory of 4584	4548	msedge.exe	84
PID 4548 wrote to memory of 4584	4548	msedge.exe	84
PID 4548 wrote to memory of 4584	4548	msedge.exe	84
PID 4548 wrote to memory of 4584	4548	msedge.exe	84
PID 4548 wrote to memory of 4584	4548	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a638044904b5232c7085d14d0c366f24_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80fb846f8,0x7ff80fb84708,0x7ff80fb84718
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,8119221952113388089,17177401349326653632,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,8119221952113388089,17177401349326653632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,8119221952113388089,17177401349326653632,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8119221952113388089,17177401349326653632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8119221952113388089,17177401349326653632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8119221952113388089,17177401349326653632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,8119221952113388089,17177401349326653632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,8119221952113388089,17177401349326653632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8119221952113388089,17177401349326653632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8119221952113388089,17177401349326653632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8119221952113388089,17177401349326653632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8119221952113388089,17177401349326653632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,8119221952113388089,17177401349326653632,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 cb22f29284b63ef8bf63a08f94c9ddee0e0d9ae679b9aa5a2f20c3ca06552466
MD5 fe0fc71018dc710eeb316aab970dcd96
SHA1 c9c68c8879af37928529a5b64d304dc3fd2cc5bf
SHA512 53e1e5cde2f77ccc37c0265fa938fd8ac811fbdb3ca9231d7d1782eb6911623bd51104fc4a2d69e5913e1130fc11614c057780205bf9c9d5c2e4957c6065b91e
SSDEEP 96:nAkGy1in2wpvWMoiVmdeHk4bUWQyV+VDCziEwb:nAkJUn2GWMXFro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 bbb2604bef0c2b4b26f733b7bd07303f7e4017125c0b3f254b5c872d002011ef
MD5 dd5051cf58a5d2176299f3772cfb4410
SHA1 c863abf7acdd6497928adb9f652055849b7fff0a
SHA512 c6746c70179431528e54c65c81fb80b7dceda4ace291ca7d0704a4e77a52f669053870659eb938fd1b6128d8d105da15921b0c5a03545ba1d8c7fde0986100bc
SSDEEP 96:nAkGy1ig2wpvWMoiVmdeHk4bUWQyV+VDCAiEwb:nAkJUg2GWMXFrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0ab3f33aeb32b3aa0f0579c75d788ccfc72fd1a3ddb768e4f89a558e0d83afbc
MD5 d2d09e849573f21b7d3865428f37b11e
SHA1 21e851f9b45ab3ac3b2630e0288981b5f84f4069
SHA512 6ebfef83d87219fa9f7f67e318dd6850a1c7f582c8a4523aaf07a9987ea398cf0b1f2454f536e71bbbbeedd2a134059b7a7e42bf121deb2b2d414e6ce7dff1a2
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupdTze2RUFy4VH:A9iIxuERzA83h09RZxYJmH
MD5 SHA1 SHA512 SSDEEP

Submit Download