9efb17c36b53dd5f705c0eaebbda2c03cfa8d71d7069fb07b4f87f46a39c0a9f

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 01:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

22907e4058dc52e02f0a33e821e164cb_JaffaCakes118.html
Size

18KB
MD5

22907e4058dc52e02f0a33e821e164cb
SHA1

d3f9031845d0bb6434f3bb31bbb4df5afe550401
SHA256

9efb17c36b53dd5f705c0eaebbda2c03cfa8d71d7069fb07b4f87f46a39c0a9f
SHA512

36a0cab0c3bad93baea9469e572a38e69f0c7fda03dc3ed4e64e1d3f86ddc34d0463db23e373f4203cbd99e7f37540048ffcdd664c0e58203cd354f7504921f5
SSDEEP

384:Xs6vPLS7nXwft0ULcT38ZtAeHQN50KorDUzNZN98P:Xs1wft0ULcT38ZtF80KhN/98P

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
2644	msedge.exe
2644	msedge.exe
2676	identity_helper.exe
2676	identity_helper.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4360	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4360	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 1452	2644	msedge.exe	83
PID 2644 wrote to memory of 1452	2644	msedge.exe	83
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 3588	2644	msedge.exe	84
PID 2644 wrote to memory of 1036	2644	msedge.exe	85
PID 2644 wrote to memory of 1036	2644	msedge.exe	85
PID 2644 wrote to memory of 884	2644	msedge.exe	86
PID 2644 wrote to memory of 884	2644	msedge.exe	86
PID 2644 wrote to memory of 884	2644	msedge.exe	86
PID 2644 wrote to memory of 884	2644	msedge.exe	86
PID 2644 wrote to memory of 884	2644	msedge.exe	86
PID 2644 wrote to memory of 884	2644	msedge.exe	86
PID 2644 wrote to memory of 884	2644	msedge.exe	86
PID 2644 wrote to memory of 884	2644	msedge.exe	86
PID 2644 wrote to memory of 884	2644	msedge.exe	86
PID 2644 wrote to memory of 884	2644	msedge.exe	86
PID 2644 wrote to memory of 884	2644	msedge.exe	86
PID 2644 wrote to memory of 884	2644	msedge.exe	86
PID 2644 wrote to memory of 884	2644	msedge.exe	86
PID 2644 wrote to memory of 884	2644	msedge.exe	86
PID 2644 wrote to memory of 884	2644	msedge.exe	86
PID 2644 wrote to memory of 884	2644	msedge.exe	86
PID 2644 wrote to memory of 884	2644	msedge.exe	86
PID 2644 wrote to memory of 884	2644	msedge.exe	86
PID 2644 wrote to memory of 884	2644	msedge.exe	86
PID 2644 wrote to memory of 884	2644	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\22907e4058dc52e02f0a33e821e164cb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2df146f8,0x7ffa2df14708,0x7ffa2df14718
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,9852412170130690430,2754585844105574985,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,9852412170130690430,2754585844105574985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,9852412170130690430,2754585844105574985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9852412170130690430,2754585844105574985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9852412170130690430,2754585844105574985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,9852412170130690430,2754585844105574985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,9852412170130690430,2754585844105574985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9852412170130690430,2754585844105574985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9852412170130690430,2754585844105574985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9852412170130690430,2754585844105574985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9852412170130690430,2754585844105574985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,9852412170130690430,2754585844105574985,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6272 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1080

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x470 0x3d0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1a577b697695dc8f14c4f15b55513b9e

SHA1
3ac2c8292cb4e59e354915e7650be3dffb36783f

SHA256
8348f18d8707c64e85fbed0874b8fbad43ad157f82d32e7db110f8f00c1e2519

SHA512
e7b2a8f8821a093e73561f68716d27da3f3ca654fb539c6164c3a8b9d3b9fb8befc7719e8c08f3032e543ce647217d0a2e51cef2baf526cf6013e9179cf9885b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04734e0842ef86f557a0cd516e9718e6

SHA1
0a9f597155c23953584a4a32c089fa5ce777ad68

SHA256
cbabbbfc1a423ed2e6839a2cd06e71d3fa657eed9f00c54e68631cc1128461cf

SHA512
fbd56733e03eada99cd06303f90cf656f21e19368647bd5c48cec3925905b183c9ca2a1a79b20c73108e109ecd0ee865da6073d3112e9c73f6b6c6812082490c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7aaf297ee200a7045fc961f167d3ad72

SHA1
1328a7ca2b02c036b850bf09191aa6ca128ea8b8

SHA256
0b5a5c35572f3e95046137e8dc580b0420298505c97e53981b58b948bb8db8bc

SHA512
1777a0219bd294c6bfa7a50864db366d0ef2b36415b7e4e08f08adc97c3b6f0e5f2fe44b3ef1bb6391594819c000be15c2fdfaf71ed3f7eceea5d174c4315763

Download Submit
C:\Users\Admin\AppData\Local\speech\Microsoft\Speech\Files\UserLexicons\SP_87045FD8B1094D12890306E934F5BB96.dat

Filesize
940B

MD5
289730a13e6a1feb400495b4d0100ac7

SHA1
2a46eaee6841361aba0893dd7837bd5a3ec641df

SHA256
91e3b29976b120d7b07917f9cc8cdad07a647e6c2f730eb44be812d407a00793

SHA512
4aee62233bae1a14f89a12de49ea97d97a3b0b25d018b963df04d1e6eb8effa2bfccc600810cc88060e7961c078193bd904ad6cb211ab04cb9274d9307efac81

Download Submit