a8d59bc7d51b2a395102a114abb09f9416122937dcbeab7cd3a53e59615f57c8

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6951c8b7ae6772b8565daae4425cd953_JaffaCakes118.html
Size

43KB
MD5

6951c8b7ae6772b8565daae4425cd953
SHA1

117c9a4eab78461269d7b0aa74e61ceb0d0ac2bb
SHA256

a8d59bc7d51b2a395102a114abb09f9416122937dcbeab7cd3a53e59615f57c8
SHA512

3b6e5b42e5fe9755fe79b73bbc446fe921ea2755e19c5d4ad0ba937db93ddf6b1286cee2d65a5f85cf79f4003c444804840baedb62920613290535d11892a2a8
SSDEEP

768:SQlbX7nngJUFJnnCB9U7oqIuVfF8z6uPD+w0yF0SUeVEq0ryy9hkny0+wn9A:SQlbLnngJUFJnnCB67TIuVfF8z6uPD+t

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1252	msedge.exe
1252	msedge.exe
2888	msedge.exe
2888	msedge.exe
5056	identity_helper.exe
5056	identity_helper.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2888 msedge.exe
2888 msedge.exe
2888 msedge.exe
2888 msedge.exe
2888 msedge.exe
2888 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2888 wrote to memory of 2524	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2524	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 3516	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1252	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1252	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 1828	2888	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6951c8b7ae6772b8565daae4425cd953_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff12ef46f8,0x7fff12ef4708,0x7fff12ef4718
2⤵
PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,12643840299947131620,14571621633320499041,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
2⤵
PID:3516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,12643840299947131620,14571621633320499041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,12643840299947131620,14571621633320499041,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
2⤵
PID:1828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12643840299947131620,14571621633320499041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
2⤵
PID:2604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12643840299947131620,14571621633320499041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,12643840299947131620,14571621633320499041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
2⤵
PID:1016

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,12643840299947131620,14571621633320499041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12643840299947131620,14571621633320499041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
2⤵
PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12643840299947131620,14571621633320499041,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
2⤵
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12643840299947131620,14571621633320499041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1
2⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12643840299947131620,14571621633320499041,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
2⤵
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,12643840299947131620,14571621633320499041,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
184B

MD5
45996eb12c5b1a531a2d9a3f56b913ff

SHA1
c61935c0ab773fc8ca70f30b06620bd6e304c092

SHA256
9f1f531b5d1eb3c957e2a57f0d59533bd7bb5da6f59e230b70b1e942e6dcca33

SHA512
06455d33c060be6c22db298dfd4585f15d853d471e7ebee67e35c7fd2526261e400ca536cc3e3b3acf32175ea3b8ed41ee1c0e5bd3fa811e0217d1a078af42da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
008fa0d8e33c2477769a12a06d7b7ebe

SHA1
5e93813303e706e1faa850d208a42e38d9f8c589

SHA256
4d0dd7370d184a78157b0b49bec7b6be04b96413bad4dafbfa4bf6a39c889b50

SHA512
af8aed83e0dcc2847d4a974894fb3cb5f486148e72ba534691a2b361e507d2e5f4b76e0fb5c3af700bef5cef2d1ab7e39f6a6b6ead6ffe4c84674d29eb6e41cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a139a46f5979afedc8d21bf0578c748f

SHA1
865da9bc04227b13fbaa422eadeba9d0614792e3

SHA256
133835c39abf4a908095ca6a50383504cc5006aa0de349c9136048a4e099b61d

SHA512
29ef557864996d77af05f2af91ec6f1577f929695ddb6f0a4ab64efc97d9770c11587c6e3a24f0958e8a0082ae944668b609aceba779b114275e04a504f1d940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
aa64ded6657e547008ac67a04344289d

SHA1
b05991741eb1376fa0d62d4759331ebfe95db142

SHA256
0de3de28b78e979d7b6e45209abb4e2cc1123602d01d5908dcc72f79007ed769

SHA512
927388311cbbad91359c5cf4427b9618a06bd4cf903ef454d76ac516bc836f4d4d6a7fabe830bd1d2474d482e3981029fbfec5ecae34af5320efeffac1518dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
0302e0b2669907c50efd95c70b0d6ab4

SHA1
5f7f1e984591b7ae25288c0a7d35ee3abf2af190

SHA256
26e0a08301c95bb8b149962f79fba09dd74c0b41d749744a30b6b5bc31bc2ce1

SHA512
5a555a64de85b8ff1b16c0dbb8316467eba739ca0a43b0a021336df5840bef3ed6deb053d0877c99f05edef888c453bdacc803fa854853324950ec5dc5c4ca1c

Download Submit
\??\pipe\LOCAL\crashpad_2888_CUFUWTLSHNMXZCBD
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit