ac95ea157c3626c1b6d1c9d8f0094436024d40b77361431c28af6ae921336708

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6594f53e10c7ee5b03079f02a8d9640f_JaffaCakes118.html
Size

41KB
MD5

6594f53e10c7ee5b03079f02a8d9640f
SHA1

49cd8bba8ff9e277a1a13774ba22ab54957ee705
SHA256

ac95ea157c3626c1b6d1c9d8f0094436024d40b77361431c28af6ae921336708
SHA512

3b56a5003129c06dece5ca5da99ed574109ad7d2f341778680a804296c2ac203acc36a3c45c28d63ab39647bf3e435974b0da147129adaf1de63c587877bc1b0
SSDEEP

768:cLSfd89vJE3YZYrkt4fGNfFx/yH3WPh9Tun7xQpno0wYtmUoIYWAOOGMk7uyWypG:cLQdMxIYZYrkt4fG9Fx/yH3WPh9Tun7/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2760	msedge.exe
2760	msedge.exe
640	msedge.exe
640	msedge.exe
116	identity_helper.exe
116	identity_helper.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

640 msedge.exe
640 msedge.exe
640 msedge.exe
640 msedge.exe
640 msedge.exe
640 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 640 wrote to memory of 4516	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 4516	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 3912	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 2760	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 2760	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe
PID 640 wrote to memory of 1020	640	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6594f53e10c7ee5b03079f02a8d9640f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb884446f8,0x7ffb88444708,0x7ffb88444718
2⤵
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11391783524954097471,12338072302062801887,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
2⤵
PID:3912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,11391783524954097471,12338072302062801887,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,11391783524954097471,12338072302062801887,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
2⤵
PID:1020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11391783524954097471,12338072302062801887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
2⤵
PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11391783524954097471,12338072302062801887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
2⤵
PID:1836

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11391783524954097471,12338072302062801887,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
2⤵
PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11391783524954097471,12338072302062801887,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11391783524954097471,12338072302062801887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
2⤵
PID:4012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11391783524954097471,12338072302062801887,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
2⤵
PID:1676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11391783524954097471,12338072302062801887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
2⤵
PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11391783524954097471,12338072302062801887,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
2⤵
PID:3272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11391783524954097471,12338072302062801887,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4748 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
309B

MD5
71b15cf123441f7045dae1c1a5347818

SHA1
a13fde2d1d48aadf2dce0564c130dd22e16faf0f

SHA256
857939d27aa8045d291678fd89e282e6c3fc43395ff894dae1477fbde1bfdd18

SHA512
271479edf7869b49d9abb2ed9195641952c059c4e8ac2daf7c621af11acf14a29477f4f933f41020ce3b17ddacd81ab6b9b7afff9da7bd61f30387a954ac7259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4342681d185f13d92a42361f7f7aba73

SHA1
e2eaa979398ac1ff76ac69e2d11bfafea36f4264

SHA256
5be6fe05cb878b007cfdf845b3319118155e93896e47cc7531a4e41895e1ece6

SHA512
d9878bd805e301175a437897c73c8d83c75bf3e27a05907c72de6cff771d10e13db1a0dc09f962fa113acb082e1fe7fa780bd237e63e6ceab89f97cbaa36ed67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9e6ef19bf3741553b8331290d481fef2

SHA1
55c4f1f008a11ab933d2d3e37f952f9f5789e69c

SHA256
74b0efc6129c3667073c5328a528045e57131a915aef3af839a94718e9fb803f

SHA512
3767d1a8f0d182429797a8154d005dcca30a0e4ca6fe234863cb763213620925524bbce7b03dc42dffa04ce90a4a36dc3401e6317f0ff8b060b844285edd913a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0079434a5d2e35c982f3fe6fe5133584

SHA1
bd7ef5212d46c68e78543d7f05e1f8486fde4304

SHA256
ed5bd57661b88c710cd98ea0d5ada7414b94d8a221a0d2267b76067418c2086f

SHA512
863fb6497f446c04262da7c83d32d3da6c7c35170840458e72aeda37033408e5db9cc43d3fce8c74ea66b39d722599848550d59b400b970f488912d13bb57382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1b6cf45a2919eb495e2f0a7529cd1bcf

SHA1
eb1de5eb7a89048b4fbc664c80c9fb105d2a5e57

SHA256
9a788bef0e0687ee6743b4dd936876f1e61dca2fd315d4fdc2dc913286f5b7a0

SHA512
a14356647e383f07fdf7bf22cfc61bebe3399d83a69bbeec2cebebbe5b8e473555fed233b2305c549e63ec778c6b8b69dc18b30671a239d48bc771505214d6aa

Download Submit
\??\pipe\LOCAL\crashpad_640_JWCTJFHCRAOZFXHX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit