95ab69a3c0492fc2119178b95126585251f279e6e93b1943827e74e46ca7ed1a

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fd84242a89121321f2f7adf3f7bc275f_JaffaCakes118.html
Size

126KB
MD5

fd84242a89121321f2f7adf3f7bc275f
SHA1

49093ba71896a512235e142d4d5ac8edaa3c5315
SHA256

95ab69a3c0492fc2119178b95126585251f279e6e93b1943827e74e46ca7ed1a
SHA512

a3f586f2ce551220b0c11498da36913212b88094bc8cfff2eb016e366d5a567040ac8a4ae4717fd89681ae53658089548682998b1a715cb5790b27f2fdd46670
SSDEEP

768:SIpXPv+yCDoxNQ5+G8y1VFKLUQAw3ols0U7+tsxYm/gJ2XPt4+RSiwWkzRLU2QDJ:SIpX68l87JBy5deYPdmo

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3076	msedge.exe
3076	msedge.exe
2404	msedge.exe
2404	msedge.exe
5080	identity_helper.exe
5080	identity_helper.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 4968	2404	msedge.exe	86
PID 2404 wrote to memory of 4968	2404	msedge.exe	86
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3312	2404	msedge.exe	87
PID 2404 wrote to memory of 3076	2404	msedge.exe	88
PID 2404 wrote to memory of 3076	2404	msedge.exe	88
PID 2404 wrote to memory of 1264	2404	msedge.exe	89
PID 2404 wrote to memory of 1264	2404	msedge.exe	89
PID 2404 wrote to memory of 1264	2404	msedge.exe	89
PID 2404 wrote to memory of 1264	2404	msedge.exe	89
PID 2404 wrote to memory of 1264	2404	msedge.exe	89
PID 2404 wrote to memory of 1264	2404	msedge.exe	89
PID 2404 wrote to memory of 1264	2404	msedge.exe	89
PID 2404 wrote to memory of 1264	2404	msedge.exe	89
PID 2404 wrote to memory of 1264	2404	msedge.exe	89
PID 2404 wrote to memory of 1264	2404	msedge.exe	89
PID 2404 wrote to memory of 1264	2404	msedge.exe	89
PID 2404 wrote to memory of 1264	2404	msedge.exe	89
PID 2404 wrote to memory of 1264	2404	msedge.exe	89
PID 2404 wrote to memory of 1264	2404	msedge.exe	89
PID 2404 wrote to memory of 1264	2404	msedge.exe	89
PID 2404 wrote to memory of 1264	2404	msedge.exe	89
PID 2404 wrote to memory of 1264	2404	msedge.exe	89
PID 2404 wrote to memory of 1264	2404	msedge.exe	89
PID 2404 wrote to memory of 1264	2404	msedge.exe	89
PID 2404 wrote to memory of 1264	2404	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fd84242a89121321f2f7adf3f7bc275f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe2ae746f8,0x7ffe2ae74708,0x7ffe2ae74718
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,6871129889471179080,14857090240060679552,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,6871129889471179080,14857090240060679552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,6871129889471179080,14857090240060679552,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6871129889471179080,14857090240060679552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6871129889471179080,14857090240060679552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6871129889471179080,14857090240060679552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6871129889471179080,14857090240060679552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,6871129889471179080,14857090240060679552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,6871129889471179080,14857090240060679552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6871129889471179080,14857090240060679552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1364 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6871129889471179080,14857090240060679552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6871129889471179080,14857090240060679552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6871129889471179080,14857090240060679552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,6871129889471179080,14857090240060679552,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e36b219dcae7d32ec82cec3245512f80

SHA1
6b2bd46e4f6628d66f7ec4b5c399b8c9115a9466

SHA256
16bc6f47bbfbd4e54c3163dafe784486b72d0b78e6ea3593122edb338448a27b

SHA512
fc539c461d87141a180cf71bb6a636c75517e5e7226e76b71fd64e834dcacc88fcaaa92a9a00999bc0afc4fb93b7304b068000f14653c05ff03dd7baef3f225c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
559ff144c30d6a7102ec298fb7c261c4

SHA1
badecb08f9a6c849ce5b30c348156b45ac9120b9

SHA256
5444032cb994b90287c0262f2fba16f38e339073fd89aa3ab2592dfebc3e6f10

SHA512
3a45661fc29e312aa643a12447bffdab83128fe5124077a870090081af6aaa4cf0bd021889ab1df5cd40f44adb055b1394b31313515c2929f714824c89fd0f04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
248B

MD5
1e81ba29d25201afcfdde4bda5eab45a

SHA1
964f4ed11186d9a8967f4bf98a0a0003417d947b

SHA256
04948fb9f750763822304a435c1c8d7842985bdb9710d5cb6eae834faff22ec0

SHA512
2bca4fec0118c35a32e72a22df2ddae73ed53fae0d6fecc7c0514e155c45e2a344f89795a050d118b04cdfde6083ec7ab0898a02b3632062b37a31cabbba84e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d5280ec5e4e8082dec486fc3c48958b0

SHA1
521475ce63f996cccc1ca0cd6b0019273e7544c4

SHA256
5d1e23e652aa7f8d3f32b4dfe94963f1151a7428f595e5662bf03445e49a0ffb

SHA512
34857a39f87b78b44a67bf80e6a37bd79a137f3531a520eb006600ea136d79534bbd943fe9d868461d121ccbf1030b7eac4ac85196b1f288d504415a5677ec90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
40210b3eed359cbcae6c9f4a71f3aefa

SHA1
c0bb97e25820be7c8f2fe8371227a894d8737df8

SHA256
3c2f7b3ef202e4051be5ba2b6453016b056465b3179f2f84fc29db6a60d59e1a

SHA512
b9b2cf952a392761cd254de32dc07beeef669806a4c7b13c86996f92589c0851e6b8ad28ac06e470644435148bad0ecd331927a47be155aa18799257cd3916ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a007b6986c9dbe23f3e9bc369bb1df5b

SHA1
fb93f62d6dbb52cdafa3647376cf53e2078b1d6e

SHA256
53918ae1a297021a63a0154645192f1da438ccd470767c74438fbf266a6d4195

SHA512
c130c4b511b033eb05f39f7e3f5df44ca31fb1d23b1df57e3e79476fd5d476318661806c135a08a7521d34349894a2fb28d7c8168fb48816a470f6747eb76bd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d220c515d07ea1d53579a35ae61d071f

SHA1
b0032c1db82d4a1c52be2bc9340453de5afb39fe

SHA256
2a0442f3c7dae237413affcb7774f5ff497a926cfb4e9001bf2dfaae9165554c

SHA512
6467161ffd656710bb62c0c46e23032036188d11e6e6ee421d3738e4f831b32a6a931f565a206ac7d02a35e884d51af6da0158f806afc9cc5d22eb1b68014b52

Download Submit