f114cff92b4e900e630dc240ba1c7fcae0fa96bdd321ca1fc53ed331a9952cbd

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68eddaa87c5f406a0c76aa6bde4dcc67_JaffaCakes118.html
Size

19KB
MD5

68eddaa87c5f406a0c76aa6bde4dcc67
SHA1

7dfc1eabab2129c6bf7b80a0ea805a86fc4f0b2a
SHA256

f114cff92b4e900e630dc240ba1c7fcae0fa96bdd321ca1fc53ed331a9952cbd
SHA512

06c9a1f37351854bc8914793f5b1e82dccf698e57f6ef1a001f5dcd9f84ef89975ab9e6cdba11e7ae5cd7fb42e4bcb97c3bfe0c0f2644405b695acd9f58b9d27
SSDEEP

192:9K/ypUhTSMiqEW+LTgE9d31UF5uCUNvbq5ucMQBQjjQZ8kEV7qoW+hEUbZbq5uiG:4/yoTniPLXfn5c4QtYdEp55iDieiC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1728	msedge.exe
1728	msedge.exe
776	msedge.exe
776	msedge.exe
2360	identity_helper.exe
2360	identity_helper.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

776 msedge.exe
776 msedge.exe
776 msedge.exe
776 msedge.exe
776 msedge.exe
776 msedge.exe
776 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 776 wrote to memory of 1340	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1340	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1524	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1728	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 1728	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe
PID 776 wrote to memory of 2548	776	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68eddaa87c5f406a0c76aa6bde4dcc67_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc074f46f8,0x7ffc074f4708,0x7ffc074f4718
2⤵
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,6335613914523533910,13478952023633252631,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
2⤵
PID:1524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,6335613914523533910,13478952023633252631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,6335613914523533910,13478952023633252631,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
2⤵
PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6335613914523533910,13478952023633252631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6335613914523533910,13478952023633252631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:2568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6335613914523533910,13478952023633252631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
2⤵
PID:1724

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6335613914523533910,13478952023633252631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
2⤵
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6335613914523533910,13478952023633252631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6335613914523533910,13478952023633252631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
2⤵
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6335613914523533910,13478952023633252631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
2⤵
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6335613914523533910,13478952023633252631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
2⤵
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6335613914523533910,13478952023633252631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:1
2⤵
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,6335613914523533910,13478952023633252631,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5856 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fc31c9d0d14399213587727dc22b7fa4

SHA1
251c9b756fb74ab05feca8ced04bd1dd2745ca39

SHA256
1819801ce84e3779130aa3cb65ff8509589753f74da468efcc65268ceddbc0e4

SHA512
b413de51dc8a48174d7fb596e2beb5598b9023da55e6e59cd5ad312712e34e679a35eb916679b97be905c844c6164f1195e6eef36ad755babca721f54bb8a0b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4c2a43a1913a8905babe1922ea022831

SHA1
0bc83a5610b30e2bc67929e934e319d1484343bd

SHA256
908017780d18dfdbac0f28f21318517c492a20973df60f38ec6faa1b36c8147b

SHA512
41ac6c987c0c38704df74b4b12c2335c126037270e4f17b9cd8d251a1b2d3dc21bda175f079aeabf82a7eeddfd89090e3e851feb6b25d6f81ddd4833ae775506

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aaa52805bbdff150da88446d5388db47

SHA1
6f6868b819832c6b2586e8b8a556e5d75acf417b

SHA256
23a7e560d8866bf68285e6df872e4263fa0b9e347657c68b8a4bdbbd0403554a

SHA512
a8b5ff3549f3e6b0f08ae94300fe857efbd8d58a91ddfded9b8d1aaa7ce81d4ced73147c80b1eb1aed19fd871156478e99c9ec2ea8ab26a24d7d4e65e69397fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
25c7381ef9e647f414ad3f6b802a70a5

SHA1
889ad85ffdbba0f4bd1dd1975e1f0c8724c1be32

SHA256
7bf44160ada4d9e511eaa557440c5a585c5f52e3538566f7c61cc6adebdad498

SHA512
ec919d1eca8bb4e1d66611f2e91df556f85acba682b683c449e84c0380bd8e1e61fcdcf39b12aac30538129f3c31c5f96b67329f46865d3f0a1408eda5b31eb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
39e00e959f33b7ecf9d10d3c843dc6ac

SHA1
a05a957b52a9f89d43e15e96d71b103ff743f6bc

SHA256
9a4f46c5ab02ed02ad3cafddc242d6feb3675ad80d6298f230a0893928718cca

SHA512
0b7ca4c3326685c96d70c79339ee4c424c0ddd06bcf2fde9a706bcced0ec73f1884e9a3163b3b0742c72172bf713781b41c7526853f671a34c7d1b7d85aed725

Download Submit
\??\pipe\LOCAL\crashpad_776_JJXOZTOCZEXQJCKK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit