ae75c109183a8b249e44f569eed7f57efcf6b523733f442aa9a62564fbb108a6

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fd0a1fe9b0fcb5a3fae8ddb911c64db_JaffaCakes118.html
Size

56KB
MD5

1fd0a1fe9b0fcb5a3fae8ddb911c64db
SHA1

a02d93e123a8a9fd8fd54bf54087209b088de7c9
SHA256

ae75c109183a8b249e44f569eed7f57efcf6b523733f442aa9a62564fbb108a6
SHA512

9f00e90fa81f8112b9e354f5be747c96b88e1e3e8013cad9b8b751906a7c026d8a5a0e7defb97c3793913868325750304bdc6d1808dd2a2dfb8617abd654ffd9
SSDEEP

1536:wFktQS79DwR/x1Y8sD83ASnsj88yqA3AinsAA8bYrx1Y8hDe3AYnsXJ8FprnsXqw:wG79DwR/x1Y8sD83ASnsj88yqA3Ains1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
1656	msedge.exe
1656	msedge.exe
2040	identity_helper.exe
2040	identity_helper.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1504	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1504	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 4268	1656	msedge.exe	84
PID 1656 wrote to memory of 4268	1656	msedge.exe	84
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 1012	1656	msedge.exe	85
PID 1656 wrote to memory of 5100	1656	msedge.exe	86
PID 1656 wrote to memory of 5100	1656	msedge.exe	86
PID 1656 wrote to memory of 1500	1656	msedge.exe	87
PID 1656 wrote to memory of 1500	1656	msedge.exe	87
PID 1656 wrote to memory of 1500	1656	msedge.exe	87
PID 1656 wrote to memory of 1500	1656	msedge.exe	87
PID 1656 wrote to memory of 1500	1656	msedge.exe	87
PID 1656 wrote to memory of 1500	1656	msedge.exe	87
PID 1656 wrote to memory of 1500	1656	msedge.exe	87
PID 1656 wrote to memory of 1500	1656	msedge.exe	87
PID 1656 wrote to memory of 1500	1656	msedge.exe	87
PID 1656 wrote to memory of 1500	1656	msedge.exe	87
PID 1656 wrote to memory of 1500	1656	msedge.exe	87
PID 1656 wrote to memory of 1500	1656	msedge.exe	87
PID 1656 wrote to memory of 1500	1656	msedge.exe	87
PID 1656 wrote to memory of 1500	1656	msedge.exe	87
PID 1656 wrote to memory of 1500	1656	msedge.exe	87
PID 1656 wrote to memory of 1500	1656	msedge.exe	87
PID 1656 wrote to memory of 1500	1656	msedge.exe	87
PID 1656 wrote to memory of 1500	1656	msedge.exe	87
PID 1656 wrote to memory of 1500	1656	msedge.exe	87
PID 1656 wrote to memory of 1500	1656	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1fd0a1fe9b0fcb5a3fae8ddb911c64db_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffabc546f8,0x7fffabc54708,0x7fffabc54718
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,12436964252265215652,12496255872829929385,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,12436964252265215652,12496255872829929385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,12436964252265215652,12496255872829929385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12436964252265215652,12496255872829929385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12436964252265215652,12496255872829929385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2076,12436964252265215652,12496255872829929385,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,12436964252265215652,12496255872829929385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,12436964252265215652,12496255872829929385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12436964252265215652,12496255872829929385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12436964252265215652,12496255872829929385,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12436964252265215652,12496255872829929385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12436964252265215652,12496255872829929385,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,12436964252265215652,12496255872829929385,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2984 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2732

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x49c 0x4c4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
265B

MD5
426c95e16a5c93c0bd9f3902317b7c4c

SHA1
3fbb36a0dfa83a6a3780273530dfe3b4de60313e

SHA256
c17137d914c28178be5476ba3983d5c5ff9a3cdaece3b8f6cea65909ab4dfe86

SHA512
67f0d1395b5554fce982a3d3240a1bffb41235bdad9c6a8fe56c219130f9a7e6a189a0c9260ac6086fedab30c9a2157bd9278e611b6ca80f0e74b752ac8dadef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4152a0903e75afae5d98221d9c667644

SHA1
579acb6ac07c55eb54bd96ac801cbd5c081266f0

SHA256
63f4d6f18973e1f89a1a585818449a116e0d5f56922b94e3187aa59d9bd47614

SHA512
fffec468ac31603af0a0615bf4392f7e94e4a9f5fa17650162d3038f1c3e426f55baafeb56c88951ea6ac18a3b97e1d9db6620fe670cfb551aaebc67eef6d6aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
252b7c30b84097fa329d14d3ff37a8c4

SHA1
e608dfd395a2aefd5de78f09cf2ed92e9f611643

SHA256
41ad3c30b3663459cbd5df5da2d4ebc83dea672d1be2030e4a8e7b7d7110cacc

SHA512
2cdbd5a8377fbcb7edab500ed962aa691d1965f47e7e2c4b9c5f1932e2c88a18ac54d5c19b56d137f87cd0db77821f3cbff438072ee7f101c8eb74105baefcef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
51ab7fbf3f0a7e4c9f3934a0cb2155d5

SHA1
5fa45703df71dac677ea9000447e73c4d3e23a1c

SHA256
93bb928ee74c940cc513197e6e3b56a9dbfcbeb28894ee18a9add6981230fa51

SHA512
85259096a62b28a26fab5ff47f4db5e219a2c608cd22d2d5c18406e6bf9d6506f9a72b04a5cc73a4ad4eb009137d619ff1b9ea3a798dc2d7071bb2407f158bb8

Download Submit