5980e3343dad8f199e0c6970bbc5db249ab709aed29c9e613cb739e10b21125c

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4c3ae8da1e2e9cf44dacf24e91252fbc_JaffaCakes118.html
Size 53KB
Sample240716-brn1faydnl
SHA256 5980e3343dad8f199e0c6970bbc5db249ab709aed29c9e613cb739e10b21125c
MD5 4c3ae8da1e2e9cf44dacf24e91252fbc
SHA1 e0fff472fb9e35ab03ef843a18f3fc023e6d8bfa
SHA512 fecdc8ebc96aebace4318d648d0a33295441ebc526463ee815685720c54e0e049b2428661d10b96b2eb8a9a90f09bc73c38be74bac7cb4b91936b60918683fbd
SSDEEP 1536:CkgUiIakTqGivi+PyUJrunlY463Nj+q5Vy0R0w2AzTICbbLRoh/t9M/dNwIUTDmW:CkgUiIakTqGivi+PyUJrunlY463Nj+q8
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
872	msedge.exe
872	msedge.exe
1696	msedge.exe
1696	msedge.exe
4076	identity_helper.exe
4076	identity_helper.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1964	1696	msedge.exe	83
PID 1696 wrote to memory of 1964	1696	msedge.exe	83
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 3948	1696	msedge.exe	84
PID 1696 wrote to memory of 872	1696	msedge.exe	85
PID 1696 wrote to memory of 872	1696	msedge.exe	85
PID 1696 wrote to memory of 2508	1696	msedge.exe	86
PID 1696 wrote to memory of 2508	1696	msedge.exe	86
PID 1696 wrote to memory of 2508	1696	msedge.exe	86
PID 1696 wrote to memory of 2508	1696	msedge.exe	86
PID 1696 wrote to memory of 2508	1696	msedge.exe	86
PID 1696 wrote to memory of 2508	1696	msedge.exe	86
PID 1696 wrote to memory of 2508	1696	msedge.exe	86
PID 1696 wrote to memory of 2508	1696	msedge.exe	86
PID 1696 wrote to memory of 2508	1696	msedge.exe	86
PID 1696 wrote to memory of 2508	1696	msedge.exe	86
PID 1696 wrote to memory of 2508	1696	msedge.exe	86
PID 1696 wrote to memory of 2508	1696	msedge.exe	86
PID 1696 wrote to memory of 2508	1696	msedge.exe	86
PID 1696 wrote to memory of 2508	1696	msedge.exe	86
PID 1696 wrote to memory of 2508	1696	msedge.exe	86
PID 1696 wrote to memory of 2508	1696	msedge.exe	86
PID 1696 wrote to memory of 2508	1696	msedge.exe	86
PID 1696 wrote to memory of 2508	1696	msedge.exe	86
PID 1696 wrote to memory of 2508	1696	msedge.exe	86
PID 1696 wrote to memory of 2508	1696	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4c3ae8da1e2e9cf44dacf24e91252fbc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffacc6446f8,0x7ffacc644708,0x7ffacc644718
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,7669220787748126660,5211913021057242018,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,7669220787748126660,5211913021057242018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,7669220787748126660,5211913021057242018,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7669220787748126660,5211913021057242018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7669220787748126660,5211913021057242018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7669220787748126660,5211913021057242018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,7669220787748126660,5211913021057242018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,7669220787748126660,5211913021057242018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7669220787748126660,5211913021057242018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7669220787748126660,5211913021057242018,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7669220787748126660,5211913021057242018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7669220787748126660,5211913021057242018,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,7669220787748126660,5211913021057242018,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b
MD5 eaaad45aced1889a90a8aa4c39f92659
SHA1 5c0130d9e8d1a64c97924090d9a5258b8a31b83c
SHA512 0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f
MD5 3ee50fb26a9d3f096c47ff8696c24321
SHA1 a8c83e798d2a8b31fec0820560525e80dfa4fe66
SHA512 479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 402B
SHA256 46f7383bbfe7e6360e2b5b6645a3233480169b0f867570b6c206d73c39711bf8
MD5 acf3e2cd4ad6a985c7b5be66fcca5398
SHA1 05ecf14212077603c7c00d31c56b2331567a3419
SHA512 11c7a49e853d6e7fbac33cc95ec1e679f2a8edf031afe64795ba9ce00363ce3f0874268071b36f992b1ecd7a986be3d3d492fd0e3b683d7d3a4348f7e03335c1
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 470c1e1f09986485576b3cd9fb45944e7c954d51be20596cf7756f57c7b079e0
MD5 a9f30a16c84ca5cd8f31a60dd3685ec5
SHA1 187dd6249bae1019ec2f92793abb2698d0e81d57
SHA512 565a00a5043b5eb0984e4a9a232ca4f961bed8d72602ac293d10fe2bbbc798c7dbd87a0e8ef7fd133b2e4e10ca1d81c640adc76c21925d34ee8e0a68817c0db5
SSDEEP 96:nXk3xm/vQYmqe1HJ2wpvWMoiVmdeHqmmegUWQyV+VDCziEwb:nXkckNp0GWMXBgro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 dc826cae31facb8f82fc5cdf528aedf09257895645caec763c15b31df33afcf7
MD5 476cbb8269ec4ae0538ee31c2a81e77e
SHA1 aff71c2ece6608861f3aaf3a3f00113e073f334f
SHA512 8440972ae040bf14de0043e299e0503f0e2dce908b0c781972202198818e0772a5363ec33fa5a89673c37b7aca55730e6c5d3272aeee65f6d1688897333b37ad
SSDEEP 96:nXk3xm/vnmqe1H92wpvWMoiVmde22qmmegUWQyV+VD7AiEwb:nXkc2NpQGWMG2Bgrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 26dcafa34a7b6ecdb1f190f6922c7c8ede0919e1caa43eb83d6d6c4020a0deef
MD5 662b806450ef14a7360a4c1a80c79e77
SHA1 eab09ea2f251cba71b2eff848ab8847233efabb7
SHA512 1cd2dc2a5a7ecd8213be8b1f71e1ced9906fc1f23dacdc41f40f080267c4638e86244ed39082070da1d15406423ad15f03399c497e7bdb2f3a250f1fef17c560
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupoe2RUFtJOiTKGrytYM1A/t:A9iIxuERzA83h09RZxYGJGKze+JFPpU
MD5 SHA1 SHA512 SSDEEP

Submit Download