f50003a61bbe61e918521af187afcc97a2b15034039d781e118ef341bdcb1e44

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec2a4f8aeb419461a03dd90dc9abf5d4_JaffaCakes118.html
Size

3.5MB
MD5

ec2a4f8aeb419461a03dd90dc9abf5d4
SHA1

cd7e2887c7864f1f3f18acbada0774f470e8a60a
SHA256

f50003a61bbe61e918521af187afcc97a2b15034039d781e118ef341bdcb1e44
SHA512

c33723ed0bf7ad0bdea165354b8235021d7081c17b71365b556ff3ef06c128657d7ce75e2a776f7a3a4309ce7b707783ead4738c2622543d4ff69e833833cab3
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NSM:jvpjte4tT64M

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe
1576	msedge.exe
1576	msedge.exe
4520	identity_helper.exe
4520	identity_helper.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2980	1576	msedge.exe	85
PID 1576 wrote to memory of 2980	1576	msedge.exe	85
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 1580	1576	msedge.exe	86
PID 1576 wrote to memory of 2824	1576	msedge.exe	87
PID 1576 wrote to memory of 2824	1576	msedge.exe	87
PID 1576 wrote to memory of 1964	1576	msedge.exe	88
PID 1576 wrote to memory of 1964	1576	msedge.exe	88
PID 1576 wrote to memory of 1964	1576	msedge.exe	88
PID 1576 wrote to memory of 1964	1576	msedge.exe	88
PID 1576 wrote to memory of 1964	1576	msedge.exe	88
PID 1576 wrote to memory of 1964	1576	msedge.exe	88
PID 1576 wrote to memory of 1964	1576	msedge.exe	88
PID 1576 wrote to memory of 1964	1576	msedge.exe	88
PID 1576 wrote to memory of 1964	1576	msedge.exe	88
PID 1576 wrote to memory of 1964	1576	msedge.exe	88
PID 1576 wrote to memory of 1964	1576	msedge.exe	88
PID 1576 wrote to memory of 1964	1576	msedge.exe	88
PID 1576 wrote to memory of 1964	1576	msedge.exe	88
PID 1576 wrote to memory of 1964	1576	msedge.exe	88
PID 1576 wrote to memory of 1964	1576	msedge.exe	88
PID 1576 wrote to memory of 1964	1576	msedge.exe	88
PID 1576 wrote to memory of 1964	1576	msedge.exe	88
PID 1576 wrote to memory of 1964	1576	msedge.exe	88
PID 1576 wrote to memory of 1964	1576	msedge.exe	88
PID 1576 wrote to memory of 1964	1576	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ec2a4f8aeb419461a03dd90dc9abf5d4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc7bd46f8,0x7fffc7bd4708,0x7fffc7bd4718
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6401239214015207937,10744873986720719469,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,6401239214015207937,10744873986720719469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,6401239214015207937,10744873986720719469,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6401239214015207937,10744873986720719469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6401239214015207937,10744873986720719469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6401239214015207937,10744873986720719469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6401239214015207937,10744873986720719469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6401239214015207937,10744873986720719469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6401239214015207937,10744873986720719469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6401239214015207937,10744873986720719469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6401239214015207937,10744873986720719469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6401239214015207937,10744873986720719469,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4760 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\94a01ffc-0f8c-4299-9d09-93296bffe882.tmp

Filesize
5KB

MD5
25fbcc0aeee9cef581098bdce77d769a

SHA1
83c917a49643b5d4623b3a44a711f704a9334ebb

SHA256
82af7fad7012db2488db055b3e3757ab5c00105ca3e26ff1af429cb3286f5ce2

SHA512
c0a76ad949c650ebff322874177ac5e518fc912d7c1448bd8e8d55de8e94166bf0a9eaeb5b61931c4410c48617ad04d40ce9d090dfc7af89b019f218c423e32c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
981B

MD5
2d0c78af11613e1f6ce6f846267854f1

SHA1
c0416ccedffe8338e7ff09f91f609fadf8473d81

SHA256
da9431f818c4b9929ee5f0a50b5ac20812c201f96c9377d80b7aa18e3a07383e

SHA512
a1fd29359a3c1713853ed2cc65055754c284b81478e5883c59d5bc8428ac28af2bad9b2f5f1186696aaf30be525762e25bc2dee2fd4d27a7adfeeab1a73977a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
909c41ae3f12ec230f9356dcee170d68

SHA1
f2a6faf32d71fc0b11cfe83d21ec466fa9713264

SHA256
8b880d1747217ec3458159651154a313a8e27d84f9799dbc45a9b8d0bbbc0e65

SHA512
6f874fb47472d59b2730e94d84ace6d9cb486f24b2aed97ee18644244a4af9174ece9f9249f337b4b7db4b7a01f3c1d7e0ba8b985f6b3aa63131b3ec881f54b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ea69b875eb91f5f832c9221d904d1859

SHA1
bb68301bdcd6b1a0e5c51d2488d84e4c171da0d4

SHA256
11623dcb4b5f521a8224b0b75c8666b5f4a860c994dd9972627ab5d8f129c013

SHA512
27d07e5af0ee990b88ae9249b0b2bfb320c8a9ca86e9648d26c741d324051f118d4974afbb4cd1df8b55399a9be71be7227b1ff4d94a735a5fa47b7536b3da4c

Download Submit