3f450302af82771fe079688fe340ee3db56d7948e552ca7e6113cc6f11f38ab6

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7722fb6f1906bf6b3353e17a37802aa_JaffaCakes118.html
Size 69KB
Sample240614-bedc6ssenk
SHA256 3f450302af82771fe079688fe340ee3db56d7948e552ca7e6113cc6f11f38ab6
MD5 a7722fb6f1906bf6b3353e17a37802aa
SHA1 231f0a404c2ae9299f692c7ad8284e8f0f373681
SHA512 0057f36b40c0da44aa26b951416fa4efa55e98cef2da587b9090a814d9ee48f1f24e2030d3aabc4b9b91a0e82f8d964fd279981e86ca76a9a9d6b1995ce60346
SSDEEP 768:Ji7gcMiR3sI2PDDnX0g6s+6BWPHioTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVh:J35kTzNen0tbrga94hcuNnQC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
4468	msedge.exe
4468	msedge.exe
1716	identity_helper.exe
1716	identity_helper.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 4148	4468	msedge.exe	82
PID 4468 wrote to memory of 4148	4468	msedge.exe	82
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 1412	4468	msedge.exe	83
PID 4468 wrote to memory of 2608	4468	msedge.exe	84
PID 4468 wrote to memory of 2608	4468	msedge.exe	84
PID 4468 wrote to memory of 4200	4468	msedge.exe	85
PID 4468 wrote to memory of 4200	4468	msedge.exe	85
PID 4468 wrote to memory of 4200	4468	msedge.exe	85
PID 4468 wrote to memory of 4200	4468	msedge.exe	85
PID 4468 wrote to memory of 4200	4468	msedge.exe	85
PID 4468 wrote to memory of 4200	4468	msedge.exe	85
PID 4468 wrote to memory of 4200	4468	msedge.exe	85
PID 4468 wrote to memory of 4200	4468	msedge.exe	85
PID 4468 wrote to memory of 4200	4468	msedge.exe	85
PID 4468 wrote to memory of 4200	4468	msedge.exe	85
PID 4468 wrote to memory of 4200	4468	msedge.exe	85
PID 4468 wrote to memory of 4200	4468	msedge.exe	85
PID 4468 wrote to memory of 4200	4468	msedge.exe	85
PID 4468 wrote to memory of 4200	4468	msedge.exe	85
PID 4468 wrote to memory of 4200	4468	msedge.exe	85
PID 4468 wrote to memory of 4200	4468	msedge.exe	85
PID 4468 wrote to memory of 4200	4468	msedge.exe	85
PID 4468 wrote to memory of 4200	4468	msedge.exe	85
PID 4468 wrote to memory of 4200	4468	msedge.exe	85
PID 4468 wrote to memory of 4200	4468	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a7722fb6f1906bf6b3353e17a37802aa_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe925646f8,0x7ffe92564708,0x7ffe92564718
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,304746759549341707,15003804125931770145,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,304746759549341707,15003804125931770145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,304746759549341707,15003804125931770145,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,304746759549341707,15003804125931770145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,304746759549341707,15003804125931770145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,304746759549341707,15003804125931770145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,304746759549341707,15003804125931770145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,304746759549341707,15003804125931770145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,304746759549341707,15003804125931770145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,304746759549341707,15003804125931770145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,304746759549341707,15003804125931770145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,304746759549341707,15003804125931770145,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e
MD5 db9081c34e133c32d02f593df88f047a
SHA1 a0da007c14fd0591091924edc44bee90456700c6
SHA512 12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f
MD5 3a09f853479af373691d131247040276
SHA1 1b6f098e04da87e9cf2d3284943ec2144f36ac04
SHA512 341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 aa10bb79a569b10c47497db08937ae07fe19b4280ea1b16baaa25f9dfa8f5649
MD5 64e2ddc74757a2cae783832964975a3c
SHA1 4b7428057ecfc5ee7f34d29f58a2dfbb76873df3
SHA512 9da941f210b4ce58cde413f209624aff8f5f85104387618f6a428f971783cd88bbac05ca34a2ec14e83c222b754f8bb5b0b0ccdfc0c7e12c6ba8d251063dae64
SSDEEP 96:nDkVoxm/DQYmqh1RW/wpvWMoiVmdeHgiGsOUWQyV+VDCziEwb:nDkfImjYGWMXGsOro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0cc977303db14b1845232245f313481756e3ddf809a4834bc8739fd2e17f1b58
MD5 737f1e23ff4ad7a2657d80353eb5f511
SHA1 0e67242c832ceac7118c04640b9eb0647caf2e3b
SHA512 c8c9f34986c0fa37c7ba299e5b0bcb3d03d9b0d358ac84a16604284da1bc05ef650d815acf894730dbf37bb7a1746535473c1af25bf65bff2e03bf5bf5398964
SSDEEP 96:nDkVoxm/Dnmqh1RW/wpvWMoiVmdeHgiGsOUWQyV+VDCAiEwb:nDkf6mjYGWMXGsOrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1ab276851066a81890556594e18bdee43eb0f21313b4f309436923f76cb072a3
MD5 6e03b96d3aa70c2ca18d082c0929c3da
SHA1 00cce538ba03604cd3045515714a9cfa464f6a2d
SHA512 bd3d88f8b6ae184b65a7449521d80c04ef7ca21099eab28f2e6d833ce57b415113686d8f05e6e1b7e31ec8426402a726ce0e175f02a0cf048d27cec851c7f7a2
SSDEEP 96:nDkVoxm/Dnmqh1Rm/wpvWMoiVmdeHgiGsOUWQyV+VDCAiEwb:nDkf6mjoGWMXGsOrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 da2e2c018e56d7941c5351e398d9cbddea25b5e7343633f96a2b60ac88e2b1f0
MD5 0722ab99f75780f3319c39c874d5ba0f
SHA1 e724e7df1e85a3efeb600a9ac644a21d75374a87
SHA512 bf13e9d9ac7bb55a1994f5e9b60d7d25cad87f6ac0dae2af8af3fa77036bf4c987f76ed7a95d76da11bd4ffd0d3349b49b9c18eb378528b9e5e3386762393c17
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZIde2RUs2kL3z2OMDCRHqd:A9iIxuERzA83h09RZxYZkZLaOMWRHqlb
MD5 SHA1 SHA512 SSDEEP

Submit Download