70525d59f47973a8cfc8c2fffd7d20dab212ad71bb73ac90ae17fa3df00a9b38

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

64d2ba7131a126c5d3aee97daed0185a_JaffaCakes118.html
Size

64KB
MD5

64d2ba7131a126c5d3aee97daed0185a
SHA1

9fd009e8e7a57e1851ccaa2ec66693b81d9c003a
SHA256

70525d59f47973a8cfc8c2fffd7d20dab212ad71bb73ac90ae17fa3df00a9b38
SHA512

a3deb2db8974044cb5f4057e6a34f998857e946bff18f06d131ed7ba98f9465e081749dfd48f5eb93fff7f1556779e38234294e5efd9c471ca251b03ea4939d7
SSDEEP

1536:ACC+yfE+/jYZFeWjZ6VohMo56y/X2WI2mGCGcddCOqlQ3Mku0xbzakOmBjrfjOKx:kYyI65R6sb3J

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3568	msedge.exe
3568	msedge.exe
1880	identity_helper.exe
1880	identity_helper.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 3040	3568	msedge.exe	84
PID 3568 wrote to memory of 3040	3568	msedge.exe	84
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3148	3568	msedge.exe	85
PID 3568 wrote to memory of 3516	3568	msedge.exe	86
PID 3568 wrote to memory of 3516	3568	msedge.exe	86
PID 3568 wrote to memory of 4240	3568	msedge.exe	87
PID 3568 wrote to memory of 4240	3568	msedge.exe	87
PID 3568 wrote to memory of 4240	3568	msedge.exe	87
PID 3568 wrote to memory of 4240	3568	msedge.exe	87
PID 3568 wrote to memory of 4240	3568	msedge.exe	87
PID 3568 wrote to memory of 4240	3568	msedge.exe	87
PID 3568 wrote to memory of 4240	3568	msedge.exe	87
PID 3568 wrote to memory of 4240	3568	msedge.exe	87
PID 3568 wrote to memory of 4240	3568	msedge.exe	87
PID 3568 wrote to memory of 4240	3568	msedge.exe	87
PID 3568 wrote to memory of 4240	3568	msedge.exe	87
PID 3568 wrote to memory of 4240	3568	msedge.exe	87
PID 3568 wrote to memory of 4240	3568	msedge.exe	87
PID 3568 wrote to memory of 4240	3568	msedge.exe	87
PID 3568 wrote to memory of 4240	3568	msedge.exe	87
PID 3568 wrote to memory of 4240	3568	msedge.exe	87
PID 3568 wrote to memory of 4240	3568	msedge.exe	87
PID 3568 wrote to memory of 4240	3568	msedge.exe	87
PID 3568 wrote to memory of 4240	3568	msedge.exe	87
PID 3568 wrote to memory of 4240	3568	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\64d2ba7131a126c5d3aee97daed0185a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa797e46f8,0x7ffa797e4708,0x7ffa797e4718
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6045177442028300518,6018418702933436544,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6045177442028300518,6018418702933436544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,6045177442028300518,6018418702933436544,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6045177442028300518,6018418702933436544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6045177442028300518,6018418702933436544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6045177442028300518,6018418702933436544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6045177442028300518,6018418702933436544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6045177442028300518,6018418702933436544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6045177442028300518,6018418702933436544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6045177442028300518,6018418702933436544,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2876 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6045177442028300518,6018418702933436544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6045177442028300518,6018418702933436544,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6045177442028300518,6018418702933436544,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5308 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
988B

MD5
b2f1f81a83aa19e8a2f1a25eddf1e4cc

SHA1
d153e5bad706a535a04e5373d1ad2e3327587dc0

SHA256
25e32b39172deeb07d2f36f046902ddfbe1a6b5200a0f7d4f9eaef3e101d30ec

SHA512
6076cbbb9cd3599cf6b50fa05de90021cbe104c91fcbbcfd8ef7aa203bcedf116e4c600c5ddc045f249eadde8360bd325671325ac1538d9458e6335c577f5b3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
841bc93ccf4772b616bf0d04f250d891

SHA1
9d3a9b3ccc854bac1b0903fc65e6c04ed06d3636

SHA256
96380b2e3749b8ef7e7d25130d04fea4d8f39762928122d953a604d107211c79

SHA512
70a32575a458f99a585c53389a15625ff5f4ccf1bafa24d1c019ec484997730a1f5348f98d174f17a15e5384682f06fcf2ec284e452e69a1b0066d0b694208a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cb4c2bbd22830ca8c7f2ab8ce8401edb

SHA1
a85ee871ced59dbce4bdd675095b7b8549f36e1c

SHA256
1a19bad5a7e8be760994deb9b4fe1abffb231469070e0815a427d848aab3082e

SHA512
14c050b7d60c2287354771bedc921e6684c054a606aadc72e648896aafefa253e9209038e18c9f90ffc2b4e8f11df4ee37423c5abadc5fd101d754d7b78b796a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41d2a948c036582c9bf9c8b55b6ca75d

SHA1
cf296ba5c1182a7138a791a3d3c237fd773303ed

SHA256
320f1178c6340dac3399ea17af42873b7dac63051692d9746d467912c2cac748

SHA512
5f0f212c144bdb8b26bcf141ebdb38c2bdcdbf11cb0754cc209e4b9fee5c68cea5a791996175591a353024e5af76d128fca58dc431fb1ac2339d3d2d6ac4d033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
725caead210d8d6d3d2056fb3ce6b5fe

SHA1
13bb1a58a41003e00d2a44de48d4028f62a1f187

SHA256
31ae01a240dcd77c0434d1ed8f55ef2ede22bf277307d35bf4e871b57ce71989

SHA512
959e97336cacb90a462b194877e9ba1896ddb049e7bcd52e5ea3a0c55b84b109ec63ac1b3cd34b53ed34f4a12589d8d83b8ad5d4108e8dc2c44a8af527446dd1

Download Submit