74edf1ddb404bba37f4d5c1c2ce17ae7c8bf2403a9b9a266f65ec34e4f07a7e1

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6699d7920bd256b48f34f2a73e54ccf7_JaffaCakes118.html
Size

18KB
MD5

6699d7920bd256b48f34f2a73e54ccf7
SHA1

2afb45bbbf677eb3a1888d694e1b864eadfa434e
SHA256

74edf1ddb404bba37f4d5c1c2ce17ae7c8bf2403a9b9a266f65ec34e4f07a7e1
SHA512

7ac9d359c17366fc71197e035e1978e1079add4d1e59df9c3dff7e5dd33b4f3cdce74690b88b17128bd29c513d1b7e130082c38d4a748f8101fb20e11cdd72ea
SSDEEP

192:9K/ypUhTxiq8LTgE9d37gfMwWjQDT+hRnMlUx9V6cxjb79DXSbiFGiC:4/yoTxixLXfYaQDixp55ibiYiC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
380	msedge.exe
380	msedge.exe
1448	msedge.exe
1448	msedge.exe
1948	identity_helper.exe
1948	identity_helper.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 5108	1448	msedge.exe	85
PID 1448 wrote to memory of 5108	1448	msedge.exe	85
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 1196	1448	msedge.exe	86
PID 1448 wrote to memory of 380	1448	msedge.exe	87
PID 1448 wrote to memory of 380	1448	msedge.exe	87
PID 1448 wrote to memory of 2328	1448	msedge.exe	88
PID 1448 wrote to memory of 2328	1448	msedge.exe	88
PID 1448 wrote to memory of 2328	1448	msedge.exe	88
PID 1448 wrote to memory of 2328	1448	msedge.exe	88
PID 1448 wrote to memory of 2328	1448	msedge.exe	88
PID 1448 wrote to memory of 2328	1448	msedge.exe	88
PID 1448 wrote to memory of 2328	1448	msedge.exe	88
PID 1448 wrote to memory of 2328	1448	msedge.exe	88
PID 1448 wrote to memory of 2328	1448	msedge.exe	88
PID 1448 wrote to memory of 2328	1448	msedge.exe	88
PID 1448 wrote to memory of 2328	1448	msedge.exe	88
PID 1448 wrote to memory of 2328	1448	msedge.exe	88
PID 1448 wrote to memory of 2328	1448	msedge.exe	88
PID 1448 wrote to memory of 2328	1448	msedge.exe	88
PID 1448 wrote to memory of 2328	1448	msedge.exe	88
PID 1448 wrote to memory of 2328	1448	msedge.exe	88
PID 1448 wrote to memory of 2328	1448	msedge.exe	88
PID 1448 wrote to memory of 2328	1448	msedge.exe	88
PID 1448 wrote to memory of 2328	1448	msedge.exe	88
PID 1448 wrote to memory of 2328	1448	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6699d7920bd256b48f34f2a73e54ccf7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a1dd46f8,0x7ff9a1dd4708,0x7ff9a1dd4718
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
500c2c7fa156990a3721ef89c45ca6ac

SHA1
b87b23d65a19d4065369e35de6564089e063d801

SHA256
ff721fe4168424cb7523c4779e41b9ca3887711af4d867a89ab3c3daa75ebf1b

SHA512
ab71628644e811cce765245482bd9ad0a316b51b809d75f5720a69f26437a00e64ce7756b99f884f369ee0be662e5cab471dce0cff5d258421a4274c4009dd40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bdab2dcae15db097518553283644653e

SHA1
4af13c16753b90721aee79ae217fa357855b76bf

SHA256
abd9f33de7782c2f4d04865d6a1381d42086bae0c6263c806528a93dc53d827a

SHA512
1a69290e1c3bffb8a51b504c2cb1f041e5288af1b5702705ec7c0b3e47c54e27d8caad7e7bc3ddc1e7d342110bcc31691d8976adf3f916ebcbf1af7914688594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ff0931a52a960410a9dd8258692b63b

SHA1
15642cfaeb74e53e20e417d645dbc2df22c62c10

SHA256
30c3ca6980e8536bb99efae8c69de5e3cd473b4f2984209092c29e38dd4c4d8e

SHA512
7482ae8a8a4e5c78f81aae66b513fbe981cbf17545df83968215c7a821b7e718cd857af6cbcf7acd4d318c353cca6cfe00df0974ddc62947ac024720136bdc9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6da3ff57da0822401a5d7965f1fdd447

SHA1
377ccf092c9205d52731b70e130e0996cfc8e77a

SHA256
aaa8ddd04e9fdc4ef8c6378437ad053ed4bf44adb6e8f4fa2bbebcdaa473c863

SHA512
d10cf7e0fc4e4ae4aa8e4aee872b0c9d2b5c7dd9165dd94dded7b9231ee3c53297de6cf28d0be4b0006f171c23f68f70c0cbadb02924b658a4b9c213f213d0cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b45a376b8f4290f4c51f8c9d6a90300a

SHA1
ac76b2e8c34296fc8763a5fe50130f8f4c4cc631

SHA256
28d615a1b7419f2f663d2b039f0a136906e20012204865d103b09cd6371e9e15

SHA512
754377bb295b1606ad6a07d39f562e508bf58f1505d5ee7d4f94e62fa775ae4662a4a59d05a5a1457852566038a4e3bed5e1070f10c4736be6209c49c79b7f2f

Download Submit