3bbcbde9890a02b9e6ca0146d6a2e1f40f06c94996b33e476db039f331b348d1

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6594b8af6fb27b53459362c1e8de8a7b_JaffaCakes118.html
Size

36KB
MD5

6594b8af6fb27b53459362c1e8de8a7b
SHA1

9bac3a222fae8fc1ccaa46d0ee75c69b6c9e20cd
SHA256

3bbcbde9890a02b9e6ca0146d6a2e1f40f06c94996b33e476db039f331b348d1
SHA512

6027bcec0bc5d05191a498e0b9aa9bc9200daeafe8377b9df96afd4db82404374c29edf168d873f04c4fc8e7f26ae730ce0e8404f8944ccfb67181b9f039342c
SSDEEP

768:zwx/MDTH3P88hARqZPX1E1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TyZO+6cLV6OxJyU:Q/LbJxNV0u6SF/j8bK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4996	msedge.exe
4996	msedge.exe
1488	msedge.exe
1488	msedge.exe
4776	identity_helper.exe
4776	identity_helper.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1488 msedge.exe
1488 msedge.exe
1488 msedge.exe
1488 msedge.exe
1488 msedge.exe
1488 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1488 wrote to memory of 4564	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4564	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4168	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4996	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 4996	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe
PID 1488 wrote to memory of 1948	1488	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6594b8af6fb27b53459362c1e8de8a7b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fd0746f8,0x7ff8fd074708,0x7ff8fd074718
2⤵
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17136922797981877395,12288958556263803971,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
2⤵
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,17136922797981877395,12288958556263803971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,17136922797981877395,12288958556263803971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
2⤵
PID:1948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17136922797981877395,12288958556263803971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
2⤵
PID:400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17136922797981877395,12288958556263803971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
2⤵
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,17136922797981877395,12288958556263803971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
2⤵
PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,17136922797981877395,12288958556263803971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17136922797981877395,12288958556263803971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
2⤵
PID:1412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17136922797981877395,12288958556263803971,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
2⤵
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17136922797981877395,12288958556263803971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
2⤵
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17136922797981877395,12288958556263803971,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
2⤵
PID:3576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17136922797981877395,12288958556263803971,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4720 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1408

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
614B

MD5
f2d1e26e7e36b3ee590adde315d0307a

SHA1
940fbfc5245b5644024b268241b9a6cd6675190f

SHA256
e06fa4e9ca689c3ad13841ed29a78cc3e36c219afdefbac56d869f7e19d69d97

SHA512
9ab3a4d68028616e85cf63d2bc03c7d31e5df347d962ca91750d6818dba5e3fbd720417a5937958165af38c2178e9536a9cb8018c0afe221bfa156945594e167

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
04c342d6ec5790c8e2be5c9a6c361b86

SHA1
a7ce0c10faf73bd5f59ccdcdb07305a16fbf39dd

SHA256
ad7bbbde322ac88156ec40a0cf0dc3c7914cead5b58bab93233b10cf6dbc29b4

SHA512
1468c612010b7dcf3ca8dae035c9573de0555894795b89c51c2b599216881f132db0d538aef4e091091037d501a930ef9a92503af6ceaa33061b699469a5888b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
7608c102243dd182f73d317393e3ef18

SHA1
4454622fce6eefe3e1d3ff99587d90c587255281

SHA256
9fba08d48706d47c708650ecd12fee4607e9457fef5411457650dd7c5abe6051

SHA512
56af3581470aaadedf8854e78caf571f44f6757d5cccaf4a39abda49e54a3b3be993e22f06dc725bae5b50c2b396c88eedd877e68fd6991b59f46ae648bd203d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
a49b79a14cb8610b4813e4b01f97d6f2

SHA1
4019e2c8c61ba4273f947633e8963703349ab8a2

SHA256
8e670465cb7ca07f000235a12f8f3f9ffbcf5a3e647205b6fb2815cdda115174

SHA512
3798dffe050a8df4e19d56da5ee09393f47c213504cd7e54095f003a5522c5d5f0bc4532d63e188819268f64d9d69fb23ff6906a8cfc7ff201150e92249b340f

Download Submit
\??\pipe\LOCAL\crashpad_1488_LDKITFJBQKMVDCOF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit