92b5f5d2f4c98590f3e50972cd506f837c839f560234bf8fba3955080c8e3a0f

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 07:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a4119762d3da907ecc7f2cdae8e25b1_JaffaCakes118.html
Size

68KB
MD5

6a4119762d3da907ecc7f2cdae8e25b1
SHA1

df6454cce4d775caef1dc1beb127532f076489d8
SHA256

92b5f5d2f4c98590f3e50972cd506f837c839f560234bf8fba3955080c8e3a0f
SHA512

5183dd412d51c033ff90aad2a89ef5980bec75a2d06cc6306c54ed4fe833ea88e28b8eb9f49add4c4434af329abc1145c4415248289d38293b986ad6ffe49a11
SSDEEP

1536:S8aaLSVx2tVp35D9SNtHbMO9yey3me+eTOkHB9SIgKm:S8PSV4tVB5D9ubB92l9SIgKm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3268	msedge.exe
3268	msedge.exe
1128	msedge.exe
1128	msedge.exe
212	identity_helper.exe
212	identity_helper.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2372	1128	msedge.exe	81
PID 1128 wrote to memory of 2372	1128	msedge.exe	81
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 4848	1128	msedge.exe	82
PID 1128 wrote to memory of 3268	1128	msedge.exe	83
PID 1128 wrote to memory of 3268	1128	msedge.exe	83
PID 1128 wrote to memory of 4612	1128	msedge.exe	84
PID 1128 wrote to memory of 4612	1128	msedge.exe	84
PID 1128 wrote to memory of 4612	1128	msedge.exe	84
PID 1128 wrote to memory of 4612	1128	msedge.exe	84
PID 1128 wrote to memory of 4612	1128	msedge.exe	84
PID 1128 wrote to memory of 4612	1128	msedge.exe	84
PID 1128 wrote to memory of 4612	1128	msedge.exe	84
PID 1128 wrote to memory of 4612	1128	msedge.exe	84
PID 1128 wrote to memory of 4612	1128	msedge.exe	84
PID 1128 wrote to memory of 4612	1128	msedge.exe	84
PID 1128 wrote to memory of 4612	1128	msedge.exe	84
PID 1128 wrote to memory of 4612	1128	msedge.exe	84
PID 1128 wrote to memory of 4612	1128	msedge.exe	84
PID 1128 wrote to memory of 4612	1128	msedge.exe	84
PID 1128 wrote to memory of 4612	1128	msedge.exe	84
PID 1128 wrote to memory of 4612	1128	msedge.exe	84
PID 1128 wrote to memory of 4612	1128	msedge.exe	84
PID 1128 wrote to memory of 4612	1128	msedge.exe	84
PID 1128 wrote to memory of 4612	1128	msedge.exe	84
PID 1128 wrote to memory of 4612	1128	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6a4119762d3da907ecc7f2cdae8e25b1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd168946f8,0x7ffd16894708,0x7ffd16894718
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16576116798476531721,6113346175454914597,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16576116798476531721,6113346175454914597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1960 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16576116798476531721,6113346175454914597,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16576116798476531721,6113346175454914597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16576116798476531721,6113346175454914597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16576116798476531721,6113346175454914597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16576116798476531721,6113346175454914597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16576116798476531721,6113346175454914597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16576116798476531721,6113346175454914597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16576116798476531721,6113346175454914597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16576116798476531721,6113346175454914597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16576116798476531721,6113346175454914597,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
543B

MD5
da80c94dc2542ad07b0a72a5be1340fa

SHA1
c268c493e8957a7b93e2236dfb2b3665cb771619

SHA256
6c6b1fe203db3d2e4021a95b7c5e08691ab21a9c37654f18811943dc3f2e8298

SHA512
09645c9d05e5363270f9d7b9bb3de8988efaaf68d48bbd0e7f2b05e34ce124e105df051736e8fb36436ddb21b14e1459e94f04b863029e4e9f18e2a33e714e28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5e51a7aa52d372f705c46213b434bc6d

SHA1
a9add4969d70fd535f667c6a90161e30f56b36e2

SHA256
8533cadffb87025a40b3ace92e7f64e7cefb953fd74e11807d442cf7602c4170

SHA512
0f877752d5de87d310c0df0a37bfdd65a2f37ca17147516df854e5a2b92cf78fc4791219d3f0432b30c250975274d2b1d523f7f4f71ab9b3e86dad4ef3ff3cab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dede9d3f2ed4eeff03304ed5bab99fc3

SHA1
efbe9566789ebc85172c0f866d0d6edb67489aa2

SHA256
464c70578015a11cb2442801e7ade9bd9b3d7219ab10a2432a45e2cf5f86ab82

SHA512
ffb2be5510bfb814b1eeb3ec9c7c390d41d8fa7915f6d240dfa04e1d88d2e8cb9e1db0a8c7d6a66bfd91e3e5d60f411a2632552a3f1d5b760294864b264a992e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
f3718bf7e5c570512403b556f4e5fd70

SHA1
f6a797ba13ccbc11a7feedd7e6e558fbadaee2f2

SHA256
b5bb52bd3f99f1db6f6faec6e895ff89de11700bab1c7aa11bfcafaf52b6ba17

SHA512
cd68979c9cf375971d04012d87040cf087c0bb6360b0b1684f1d7c66360108a9a195ff1822e9709a682ad453dd924aeb7508326ded3738170cbee1c6f23ff124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cd52.TMP

Filesize
372B

MD5
7af254972ac6abdb78209ef499e888f8

SHA1
1a5a0b080c12e808367a55e618e90de214289ef9

SHA256
45d5e21719737f82b37b9f1d622b5cfd6e5ed8f0dc0b4cdddf1899cd6e2e7f8f

SHA512
12c7a67bb83583507f93035599a7e4cd103f4c5634048898f844f19845a6c04211625e5e50c6d418b9baba62581806932a94f5beaff16ab67f9056d543ea2217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
01c45cfbef9e500f3562d107d4505c7d

SHA1
1f39d1ab50b5dc892588dc81f3aa126928a9957a

SHA256
91f26d742c5e97fd19cfd00f759784f9cec396a878ba8573ef8f87ad4fcb4c36

SHA512
12378427d37c9658de2698b2eb95ff510c3980ed287b89f98c3b44d3561aeb2690e049e3dca3fd9084c59a78f30af7f9bfd069e2e87fedd3708a9ab86deadf81

Download Submit