6c567ffa8b05e5a0f5f5c92c1b98c574d1bd0483d4af1c30ce9b80d018030dd4

Analysis

max time kernel
139s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ee36eba94dc6b7ae8580355ca9dda52_JaffaCakes118.html
Size

43KB
MD5

4ee36eba94dc6b7ae8580355ca9dda52
SHA1

fb4708696b443123ea75bf2f45460336721e4124
SHA256

6c567ffa8b05e5a0f5f5c92c1b98c574d1bd0483d4af1c30ce9b80d018030dd4
SHA512

740aea5ac8e60a989f23bb8b2e6af0a7e20405213b4d6de7577ebedfa812070efa15eab552ca2aa7ba9815c3f24d4e3d9d7aefed51fe250901cb0bc99847a987
SSDEEP

768:R4TqFcsOoK9k1w88u3V0IG4ORfPX1P9+Xz3/6odoYilsPd9ZI97nHR/YjEFwQxyQ:/FIu3VO1PUXmodoZ7nHR/YjEFwQxybij

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
884	msedge.exe
884	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
5056	identity_helper.exe
5056	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1392	884	msedge.exe	83
PID 884 wrote to memory of 1392	884	msedge.exe	83
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 4836	884	msedge.exe	84
PID 884 wrote to memory of 2172	884	msedge.exe	85
PID 884 wrote to memory of 2172	884	msedge.exe	85
PID 884 wrote to memory of 4596	884	msedge.exe	86
PID 884 wrote to memory of 4596	884	msedge.exe	86
PID 884 wrote to memory of 4596	884	msedge.exe	86
PID 884 wrote to memory of 4596	884	msedge.exe	86
PID 884 wrote to memory of 4596	884	msedge.exe	86
PID 884 wrote to memory of 4596	884	msedge.exe	86
PID 884 wrote to memory of 4596	884	msedge.exe	86
PID 884 wrote to memory of 4596	884	msedge.exe	86
PID 884 wrote to memory of 4596	884	msedge.exe	86
PID 884 wrote to memory of 4596	884	msedge.exe	86
PID 884 wrote to memory of 4596	884	msedge.exe	86
PID 884 wrote to memory of 4596	884	msedge.exe	86
PID 884 wrote to memory of 4596	884	msedge.exe	86
PID 884 wrote to memory of 4596	884	msedge.exe	86
PID 884 wrote to memory of 4596	884	msedge.exe	86
PID 884 wrote to memory of 4596	884	msedge.exe	86
PID 884 wrote to memory of 4596	884	msedge.exe	86
PID 884 wrote to memory of 4596	884	msedge.exe	86
PID 884 wrote to memory of 4596	884	msedge.exe	86
PID 884 wrote to memory of 4596	884	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4ee36eba94dc6b7ae8580355ca9dda52_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc37a446f8,0x7ffc37a44708,0x7ffc37a44718
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,11223454732923732705,17724682801170719829,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,11223454732923732705,17724682801170719829,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,11223454732923732705,17724682801170719829,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11223454732923732705,17724682801170719829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11223454732923732705,17724682801170719829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11223454732923732705,17724682801170719829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,11223454732923732705,17724682801170719829,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,11223454732923732705,17724682801170719829,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,11223454732923732705,17724682801170719829,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11223454732923732705,17724682801170719829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11223454732923732705,17724682801170719829,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11223454732923732705,17724682801170719829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11223454732923732705,17724682801170719829,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
eecd0e1c75b46755c373d81d853215b4

SHA1
6cebd7062c339d6793db30b6abbcbe0b6400688e

SHA256
e59c314574726dfb73b182669e6b6232153973fce4ffbb8814b47f5db03443d3

SHA512
187072a3fb1204041a1367dd122f83294186cc98cdb8d0a3b89900b72661a75c0ddaf83321bba47720c67b422f1fe392098f03cb458c4beca36560c403a2ad8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
989B

MD5
6d12e2f53be27156771561be1f5ee1fb

SHA1
e6855370ac73d54a6faf8b9ce9c874e5de0a4bcf

SHA256
5b2145991bd1191b5a93e605431c705fad42dc616c862c5425785e95dab7d809

SHA512
f9c78d538586ec08b960b13c29494ba30b2758fe7b962d8482e8a008e71f625431c3ab91f557973fc6ddc9c29051e763cc4c5d51d2c624ef0a29850cc5b03ac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
01f24720ad6ff8b31516e11e80461229

SHA1
0a18a770da353170cca7bcd9ccdb0fd85f0ab1b1

SHA256
6351bc050cf5ea69b8d350ca101ae5457100567cb162e0e979fd30c2e1a14af2

SHA512
4fd2ee6461f599cc084a68c55e82879ae8145064779805a2be89d43b2b271792b197263440ed0ff6e5d215ab19b2c9a69698a16244a59a74a85e50b90077aaf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c42616a2b0ccb87a8344c291eaf895b1

SHA1
0c6f694b3dce8f00f0914145cf62f3788ab6a708

SHA256
c0518fa97d7d494f690c9e8ba25772a9e9afcc9b756a098317b3008d845983f5

SHA512
0676028830fc6b2dea92ccb19f83853b9121d2cbc4e95e58064cb953eba8dae6f6fb6757f9d443b753b1e431e89204c35d0cb9bf336335887286ae971d3d98ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
36561797168adfcb7238a57816cbe96b

SHA1
56425515b22fd33743c3f807e894f47c89419e8e

SHA256
63fa8f79809291b246f01dbd7bf6ed1461399fa06d9473f1ba5cf461267688e9

SHA512
95a71367eb789d05fcfc9e1cf3f164f20c4b46d0f772c76f9a8c2abe640fb906144ff0b1765f99d667ff50cbe3a12fd9dc02103db5443f6a62482f3b215e6567

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b3c7098ca27c7ec8bf14643e6062fb67

SHA1
3add809974295dd3c5bfd1be5543c922f5280a2c

SHA256
6ff1fb9dfbeb60a0c36f865e7051a121ed2d35c8c75d4fa00dfe72a6c1cd9cd6

SHA512
5ed9ab9a1848b09980d55d98b9024d12245fd2b3b880ce6e444a16144a4b7ce48c1c68c26cdf795d1867fcc38cf285f01cb5b9253b1e471dc8594efe3afff835

Download Submit