5a30270f8b4b75d61d4523788b9a96a149e8b36876da5cd734ca470954db2279

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

697eecef6b06517195cf3b879db775eb_JaffaCakes118.html
Size

27KB
MD5

697eecef6b06517195cf3b879db775eb
SHA1

bd9a554683c921467a204c8787172e187eddb944
SHA256

5a30270f8b4b75d61d4523788b9a96a149e8b36876da5cd734ca470954db2279
SHA512

77bbbcadd8270da226663a8720f461c4f5b23c70858097c90dd8ac99c25eecadd8afb59d1e43c6aba81448b9e953f600bdeaaf20ffc7031daad7aaddd89487af
SSDEEP

768:H1S0m8MV4UwhZgEhyYCGCgCUCXChCWCYCDwZrINhk2Z75L/ek:H1pm1V4UwhZgEhyYP9dYu9tswZrINhke

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3160	msedge.exe
3160	msedge.exe
2552	msedge.exe
2552	msedge.exe
3560	identity_helper.exe
3560	identity_helper.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 3612	2552	msedge.exe	82
PID 2552 wrote to memory of 3612	2552	msedge.exe	82
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 4860	2552	msedge.exe	83
PID 2552 wrote to memory of 3160	2552	msedge.exe	84
PID 2552 wrote to memory of 3160	2552	msedge.exe	84
PID 2552 wrote to memory of 1676	2552	msedge.exe	85
PID 2552 wrote to memory of 1676	2552	msedge.exe	85
PID 2552 wrote to memory of 1676	2552	msedge.exe	85
PID 2552 wrote to memory of 1676	2552	msedge.exe	85
PID 2552 wrote to memory of 1676	2552	msedge.exe	85
PID 2552 wrote to memory of 1676	2552	msedge.exe	85
PID 2552 wrote to memory of 1676	2552	msedge.exe	85
PID 2552 wrote to memory of 1676	2552	msedge.exe	85
PID 2552 wrote to memory of 1676	2552	msedge.exe	85
PID 2552 wrote to memory of 1676	2552	msedge.exe	85
PID 2552 wrote to memory of 1676	2552	msedge.exe	85
PID 2552 wrote to memory of 1676	2552	msedge.exe	85
PID 2552 wrote to memory of 1676	2552	msedge.exe	85
PID 2552 wrote to memory of 1676	2552	msedge.exe	85
PID 2552 wrote to memory of 1676	2552	msedge.exe	85
PID 2552 wrote to memory of 1676	2552	msedge.exe	85
PID 2552 wrote to memory of 1676	2552	msedge.exe	85
PID 2552 wrote to memory of 1676	2552	msedge.exe	85
PID 2552 wrote to memory of 1676	2552	msedge.exe	85
PID 2552 wrote to memory of 1676	2552	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\697eecef6b06517195cf3b879db775eb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9903a46f8,0x7ff9903a4708,0x7ff9903a4718
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10415261135747864708,1911990015760631889,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,10415261135747864708,1911990015760631889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,10415261135747864708,1911990015760631889,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10415261135747864708,1911990015760631889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10415261135747864708,1911990015760631889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10415261135747864708,1911990015760631889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10415261135747864708,1911990015760631889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10415261135747864708,1911990015760631889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10415261135747864708,1911990015760631889,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10415261135747864708,1911990015760631889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10415261135747864708,1911990015760631889,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10415261135747864708,1911990015760631889,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5476 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6d916ab89fe8c7cf968f8cb01e7974d0

SHA1
a997640f504fd1ded583bb53398f45af6775af23

SHA256
4a696e28dad8434014ddb37339a538897d139b33f16c391306740812b97d928b

SHA512
1ac6d6c571c9d10b5afdc249fba170b7b965efc40813cbbaa6dfcf9e90e3c6017c47e0771f39f52c0f09ff5ebab5e343d98ff12aad9ac8fdb3353b61a06e2647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3ff413244734826800a6739f1525fb83

SHA1
48bdff357832e14ae07ab6e3abe85f5e012155a1

SHA256
d5de870b2da8747d0d8c5e24c02936b53bb14c88a282e4fb8ca259d55426a001

SHA512
a28ebd960cb6568d663b2994991627eb567bce4fdd38e225b77d9081fe524c8986f8dc30d453809a2f60da791d7f7d9bc1d4bf54686bbdbcc18e3d772fbfd6f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
992e08faa176217c1e9fe29a71c29aac

SHA1
003c352b4f12160f17d0947b818222a70cf6616a

SHA256
503fc90af4228224eb2fe47d55696c02479c66a717a2bc672b85c57e0390e97b

SHA512
af14cfc2f848bf376f6fb06bac0b883e5198d77fabe5805752dcee54b6081102765673c780c612f726bb9c3178b9f960c14bcced4f4a1795ea6b0a1142b67a4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e12c22319f30fc077f6fc76c1acbe4c9

SHA1
16ae54ed593080a404041b5d788a0ad150494df0

SHA256
a022ce2809461b2857525f5f0696b3a73469bce4229d863c97f3d6f6ef065ba1

SHA512
dd29f32cf78df2191c4f6907f4f4836027d2824d39474ed9f2169dd4de4d17235c61d6d924367e0f7ff3d9a17cf91652b65f42226ec01052caf19f03de2a477d

Download Submit