3715333325d5c3a6164c1666df627315cd6dec2abc281e28397f3e5d03159517

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6516a995736bf4c9f9aad2c6dc14411b_JaffaCakes118.html
Size

287B
MD5

6516a995736bf4c9f9aad2c6dc14411b
SHA1

5dc1851464d08082d90c9b63a621f1baa9ae117d
SHA256

3715333325d5c3a6164c1666df627315cd6dec2abc281e28397f3e5d03159517
SHA512

288bbafa95da8f072357c239b93aa3d7ec8c8963f0b9a23eab8a29f37a87f54f49f9736125ff5a5e4d2632e81f1f5d18ae54a2888045fa48b0b41fed27606a41

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
1168	msedge.exe
1168	msedge.exe
3664	identity_helper.exe
3664	identity_helper.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1472	1168	msedge.exe	82
PID 1168 wrote to memory of 1472	1168	msedge.exe	82
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3544	1168	msedge.exe	83
PID 1168 wrote to memory of 3480	1168	msedge.exe	84
PID 1168 wrote to memory of 3480	1168	msedge.exe	84
PID 1168 wrote to memory of 4688	1168	msedge.exe	85
PID 1168 wrote to memory of 4688	1168	msedge.exe	85
PID 1168 wrote to memory of 4688	1168	msedge.exe	85
PID 1168 wrote to memory of 4688	1168	msedge.exe	85
PID 1168 wrote to memory of 4688	1168	msedge.exe	85
PID 1168 wrote to memory of 4688	1168	msedge.exe	85
PID 1168 wrote to memory of 4688	1168	msedge.exe	85
PID 1168 wrote to memory of 4688	1168	msedge.exe	85
PID 1168 wrote to memory of 4688	1168	msedge.exe	85
PID 1168 wrote to memory of 4688	1168	msedge.exe	85
PID 1168 wrote to memory of 4688	1168	msedge.exe	85
PID 1168 wrote to memory of 4688	1168	msedge.exe	85
PID 1168 wrote to memory of 4688	1168	msedge.exe	85
PID 1168 wrote to memory of 4688	1168	msedge.exe	85
PID 1168 wrote to memory of 4688	1168	msedge.exe	85
PID 1168 wrote to memory of 4688	1168	msedge.exe	85
PID 1168 wrote to memory of 4688	1168	msedge.exe	85
PID 1168 wrote to memory of 4688	1168	msedge.exe	85
PID 1168 wrote to memory of 4688	1168	msedge.exe	85
PID 1168 wrote to memory of 4688	1168	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6516a995736bf4c9f9aad2c6dc14411b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe986b46f8,0x7ffe986b4708,0x7ffe986b4718
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,2368051898385874036,2165354924717252660,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,2368051898385874036,2165354924717252660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,2368051898385874036,2165354924717252660,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2368051898385874036,2165354924717252660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2368051898385874036,2165354924717252660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2368051898385874036,2165354924717252660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2368051898385874036,2165354924717252660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2368051898385874036,2165354924717252660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2368051898385874036,2165354924717252660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2368051898385874036,2165354924717252660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2368051898385874036,2165354924717252660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2368051898385874036,2165354924717252660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,2368051898385874036,2165354924717252660,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9191bc1371c6c59d3667f521de922c8a

SHA1
24da7003fd103ddb0294649d9ffc64a9b88eeecc

SHA256
83c6bd56e2850bd0647cf1e31ed68c8aedcee06508fb4e00a126b0cdd6301ebb

SHA512
1b47f23915d477518ab0dc0ea2e774810e1d1a4fa2f4f98f3c8f58f472e2e677942673bee18d3c17d6d56729f72b5ec5a2188df6e1454cf097daca1717912a1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2ddcedcc484a58d865d7f9e957d534b6

SHA1
67a62501f006d987df8bb4fe63b922c2ed233703

SHA256
c026324c037447db637bb2a07f51e5bfbf577edf625ba315c020660c72f112ae

SHA512
fc14d34a060fef63838ce7f73c137b1e8d142e41501efd92c78316652206adae069112c3886f5bf35a464a1c75d9d8b14446ae77aa867ccbf985460c2f9b822b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
359dca3956498c61111df10c321a0f6b

SHA1
b0b093ddaf2f8b12179e0ebf055020f3f8a81e47

SHA256
4ef32a45e39ec4c8e5cee374f04bb995b3bdb3c7a2df349b58aaeafee44cef99

SHA512
32d44be808d21dda9a904001c59cc2e31599eb2b6cba21a2dbd25e59536b2ce352cf58257260cef85c938f6b7281afc188932aae6fdf40f4089597fc1521e5b8

Download Submit