350f98afb3ceb65a38930011b6b933c2675bc0df33057cf82f020f44d8b9ca8c

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

461a7e3d2d6e4c97f1bc0db6b8105bf0_JaffaCakes118.html
Size

39KB
MD5

461a7e3d2d6e4c97f1bc0db6b8105bf0
SHA1

71ed486878dd61989ce8ad8da875c162e34a96f0
SHA256

350f98afb3ceb65a38930011b6b933c2675bc0df33057cf82f020f44d8b9ca8c
SHA512

8963ce42f2dd61ab887d34b8859fa8281bc5bb93fb5f4f2cd2f0083c5878612e49f6d1b08622d7490e1bd340e86f1a35875b2bce96a9834a128871855133c353
SSDEEP

768:+Dn4wMI7h/EUQFdjwzzqXfceZNpfcehi1fcebXfcex3ZM88s15hjNCgQ+htizO:+Dn4wFTzeXfceZNpfcehi1fcebXfcexZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
3584	msedge.exe
3584	msedge.exe
1428	identity_helper.exe
1428	identity_helper.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 212	3584	msedge.exe	82
PID 3584 wrote to memory of 212	3584	msedge.exe	82
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 3248	3584	msedge.exe	83
PID 3584 wrote to memory of 388	3584	msedge.exe	84
PID 3584 wrote to memory of 388	3584	msedge.exe	84
PID 3584 wrote to memory of 2936	3584	msedge.exe	85
PID 3584 wrote to memory of 2936	3584	msedge.exe	85
PID 3584 wrote to memory of 2936	3584	msedge.exe	85
PID 3584 wrote to memory of 2936	3584	msedge.exe	85
PID 3584 wrote to memory of 2936	3584	msedge.exe	85
PID 3584 wrote to memory of 2936	3584	msedge.exe	85
PID 3584 wrote to memory of 2936	3584	msedge.exe	85
PID 3584 wrote to memory of 2936	3584	msedge.exe	85
PID 3584 wrote to memory of 2936	3584	msedge.exe	85
PID 3584 wrote to memory of 2936	3584	msedge.exe	85
PID 3584 wrote to memory of 2936	3584	msedge.exe	85
PID 3584 wrote to memory of 2936	3584	msedge.exe	85
PID 3584 wrote to memory of 2936	3584	msedge.exe	85
PID 3584 wrote to memory of 2936	3584	msedge.exe	85
PID 3584 wrote to memory of 2936	3584	msedge.exe	85
PID 3584 wrote to memory of 2936	3584	msedge.exe	85
PID 3584 wrote to memory of 2936	3584	msedge.exe	85
PID 3584 wrote to memory of 2936	3584	msedge.exe	85
PID 3584 wrote to memory of 2936	3584	msedge.exe	85
PID 3584 wrote to memory of 2936	3584	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\461a7e3d2d6e4c97f1bc0db6b8105bf0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae94e46f8,0x7ffae94e4708,0x7ffae94e4718
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,10845823318874882166,2785096199918055833,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,10845823318874882166,2785096199918055833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,10845823318874882166,2785096199918055833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10845823318874882166,2785096199918055833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10845823318874882166,2785096199918055833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10845823318874882166,2785096199918055833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,10845823318874882166,2785096199918055833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,10845823318874882166,2785096199918055833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10845823318874882166,2785096199918055833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10845823318874882166,2785096199918055833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10845823318874882166,2785096199918055833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10845823318874882166,2785096199918055833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2500 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,10845823318874882166,2785096199918055833,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e1c2ed8-3cd4-4dcc-9555-0dbdbf8a481a.tmp

Filesize
6KB

MD5
761eb97ad8fed5b8a08142aef8c25c60

SHA1
5e1a037a81e4ed72b3ef2ca4ac32e00e703a9d78

SHA256
443154342b1c18b345f1c8abb0bb2281644112a7e086d7516f91f2bce92e8de1

SHA512
c346c5833ece1363c56aadb38e47466e6a1667e233f23a4919597fc3d1fb52c06368e348e139bee805e906357be929c71dc68f306a438f9febe2fcc048442212

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
342024489a7bf4e6f51ab87a8e57bc75

SHA1
96cfeb3c02fa42b1617bc8a0df9326349fe6f06d

SHA256
164dfb4600cafebd8b2ec63a7e1c6659c320ad6379ea76865b7440c2fc90c724

SHA512
c99d1c774b13556d06c30d1e4aadfb78ecd3abec5e62c7f53c491d046e4b1615cf57215ece823fa6fe7a13ce7d2eacd87dfce20af623443505587b7458659136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
264B

MD5
6082fd52d5c25e27b1037fbe8ddb2096

SHA1
eef37158e80cd359159e313e3c6d714456e8211b

SHA256
ae03439205ef97f2cf56ec13e29a44b33d556ced4c23ffe8c6bfc63d027e3d83

SHA512
52a54a4ba2796182663f4056961fb4f9ae27ed9a5b67657703c63fd137520c7ae842e4d9344a5028f47a938a317bfb95bb18e46dfe9d22c20d70170faf564c07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad5910cf06731d7eb62be478376b1f44

SHA1
44b2e084169aa08c817601023ac44058cbcac50d

SHA256
cd363d2b8621f46b820c3e5fdf7e8a167f347e1638b6cf1a4dd1a2087722e8ad

SHA512
5fea77bcd8862d559df31cd10e504d1fcc9758a6663e5875fe3481c8e8ac6131cbe66699f97c79403a13f77e183195274d219fbfabdb9efa9a6510353cbc52be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a36aea80520c42ac1ed6d0b9925f4326

SHA1
76b26b6ed75b6074b32c20accc5c092e4d0aea7c

SHA256
5841c6ff5f7fcf165086989611920f1461f59075a18d997ba8caadbaa4803fe5

SHA512
e6fb23ba11935127f08ca94fbadcd5c9fcea033047e674868d4402080267034d216add28203a75b451398e9c9446fb4c1feefdb8cd70037b2173b8e82758522b

Download Submit