79bf634a224b3d9329c6ff524357875857b271bd013e8f19113381c1eb7f1916

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

636dcd6440bfaf7b139470f6f01efa38_JaffaCakes118.html
Size

23KB
MD5

636dcd6440bfaf7b139470f6f01efa38
SHA1

30ca9c7adddda2f5df0828a5b59d041de671c441
SHA256

79bf634a224b3d9329c6ff524357875857b271bd013e8f19113381c1eb7f1916
SHA512

404705d324e8cb0030135a93b5d5d1f0c7772fbf9a0c41c69c6216c65675cf948870a9364dbb25deed41049bb383f083de549fa6058f4d09e9ba94188c3115b9
SSDEEP

192:uwOkEDagY1nDeb5nz/cQoszz+n5UvbynQjxn5Q/ZCnQiettNnrd8nQOkEntfEMlb:sQ/bv06kx3J

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe
116	msedge.exe
116	msedge.exe
4452	identity_helper.exe
4452	identity_helper.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 1480	116	msedge.exe	83
PID 116 wrote to memory of 1480	116	msedge.exe	83
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 4832	116	msedge.exe	84
PID 116 wrote to memory of 1920	116	msedge.exe	85
PID 116 wrote to memory of 1920	116	msedge.exe	85
PID 116 wrote to memory of 4872	116	msedge.exe	86
PID 116 wrote to memory of 4872	116	msedge.exe	86
PID 116 wrote to memory of 4872	116	msedge.exe	86
PID 116 wrote to memory of 4872	116	msedge.exe	86
PID 116 wrote to memory of 4872	116	msedge.exe	86
PID 116 wrote to memory of 4872	116	msedge.exe	86
PID 116 wrote to memory of 4872	116	msedge.exe	86
PID 116 wrote to memory of 4872	116	msedge.exe	86
PID 116 wrote to memory of 4872	116	msedge.exe	86
PID 116 wrote to memory of 4872	116	msedge.exe	86
PID 116 wrote to memory of 4872	116	msedge.exe	86
PID 116 wrote to memory of 4872	116	msedge.exe	86
PID 116 wrote to memory of 4872	116	msedge.exe	86
PID 116 wrote to memory of 4872	116	msedge.exe	86
PID 116 wrote to memory of 4872	116	msedge.exe	86
PID 116 wrote to memory of 4872	116	msedge.exe	86
PID 116 wrote to memory of 4872	116	msedge.exe	86
PID 116 wrote to memory of 4872	116	msedge.exe	86
PID 116 wrote to memory of 4872	116	msedge.exe	86
PID 116 wrote to memory of 4872	116	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\636dcd6440bfaf7b139470f6f01efa38_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae94e46f8,0x7ffae94e4708,0x7ffae94e4718
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,9867365337137157858,95468900462302737,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,9867365337137157858,95468900462302737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,9867365337137157858,95468900462302737,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9867365337137157858,95468900462302737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9867365337137157858,95468900462302737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,9867365337137157858,95468900462302737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,9867365337137157858,95468900462302737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9867365337137157858,95468900462302737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9867365337137157858,95468900462302737,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9867365337137157858,95468900462302737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9867365337137157858,95468900462302737,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,9867365337137157858,95468900462302737,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2d814c75a1304939d30d606e410f3a3a

SHA1
d64baa485500de5e16c8360cd24e58482c6516aa

SHA256
a134efef988050378d36a4ef34d6f0ca4ded705c1081c2e1a672169a936987a1

SHA512
e4d9c2d895752921cdf3e5a066e6e7926b8d88a59410685da868027a407be2ff75d5c5a4ed90e5c9b7d398786eab145aab9f4347e13a4de9529cfa84d13db847

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52fc637c626f1b1a3191a5f59c417b08

SHA1
f1bb7fcd2e00effdcfab6761f14d587f2f7edce4

SHA256
60aa6172e5565448f544bf0003f1e99d1f83fc27369a2fb05a1c5ef9b7f1292d

SHA512
88aeab82c754d21ef4c16ef5a35170f6df5199ebc97fdddde457c112d1dff87a7d82eaf1ff6033cfead5e70e8f660743721c2ebb6a8ed0e37affe8bfe9d9417f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
418b8e88896ee660eac411c75485d143

SHA1
209a8384a2df161b466b800eb1b12bacaf11d20b

SHA256
32132d422466730212690a401f0df4659f9fa5290ac8aa041b82f2d2155dd8c3

SHA512
36b5082e9877bfed7d681216fc6e96b118c9d3bb1c70f7d462e5d4a02357f267c5de3edc23b0ab00f09defcae68a712363dfb6e3697b97a35a9973aa659aac16

Download Submit