b9a6dc9e7cb74ca02255177aaae23d317640cc85fc84354fdb4559f9eb4e5d24

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6aefe0a660546b2decaffbfbf964e323_JaffaCakes118.html
Size

160KB
MD5

6aefe0a660546b2decaffbfbf964e323
SHA1

5fed880b5e12aaf00faf3deb5a0f335fc2439a68
SHA256

b9a6dc9e7cb74ca02255177aaae23d317640cc85fc84354fdb4559f9eb4e5d24
SHA512

8d329912e6383b034098ff03873233feb15fb4c0bbe8cf458a4a7f4ab18e45becea5ffce4268a9e5c5a9eb82839cb136d32c2dcc4cf76819eb9ee5c6e198b90a
SSDEEP

1536:DIi9cOI0fBm+ZT7xa5Ssfssv1aANOVAmV+3tl1VsZ44+xcFa+PRbt3SD+u37I3LB:DI7O96em9/ZYqS

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
1596	msedge.exe
1596	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 1112	1596	msedge.exe	82
PID 1596 wrote to memory of 1112	1596	msedge.exe	82
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 3252	1596	msedge.exe	83
PID 1596 wrote to memory of 4148	1596	msedge.exe	84
PID 1596 wrote to memory of 4148	1596	msedge.exe	84
PID 1596 wrote to memory of 4492	1596	msedge.exe	85
PID 1596 wrote to memory of 4492	1596	msedge.exe	85
PID 1596 wrote to memory of 4492	1596	msedge.exe	85
PID 1596 wrote to memory of 4492	1596	msedge.exe	85
PID 1596 wrote to memory of 4492	1596	msedge.exe	85
PID 1596 wrote to memory of 4492	1596	msedge.exe	85
PID 1596 wrote to memory of 4492	1596	msedge.exe	85
PID 1596 wrote to memory of 4492	1596	msedge.exe	85
PID 1596 wrote to memory of 4492	1596	msedge.exe	85
PID 1596 wrote to memory of 4492	1596	msedge.exe	85
PID 1596 wrote to memory of 4492	1596	msedge.exe	85
PID 1596 wrote to memory of 4492	1596	msedge.exe	85
PID 1596 wrote to memory of 4492	1596	msedge.exe	85
PID 1596 wrote to memory of 4492	1596	msedge.exe	85
PID 1596 wrote to memory of 4492	1596	msedge.exe	85
PID 1596 wrote to memory of 4492	1596	msedge.exe	85
PID 1596 wrote to memory of 4492	1596	msedge.exe	85
PID 1596 wrote to memory of 4492	1596	msedge.exe	85
PID 1596 wrote to memory of 4492	1596	msedge.exe	85
PID 1596 wrote to memory of 4492	1596	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6aefe0a660546b2decaffbfbf964e323_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9b3c846f8,0x7ff9b3c84708,0x7ff9b3c84718
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,5123887197557176318,13976711703179063864,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,5123887197557176318,13976711703179063864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,5123887197557176318,13976711703179063864,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5123887197557176318,13976711703179063864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5123887197557176318,13976711703179063864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5123887197557176318,13976711703179063864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5123887197557176318,13976711703179063864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,5123887197557176318,13976711703179063864,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\951a9db6-2fe1-496e-9f47-ca3945d5c2ea.tmp

Filesize
11KB

MD5
afdb29e678fa3f0b16a1965bdd316b90

SHA1
85dd2f500d4239474f5721a9a16daaa7f0f91c25

SHA256
2307a126848b7f2e014d618eafe4cc90b5abbd9ddc1e423438bd06f8649274d5

SHA512
77610f0135ef17caf82ba630bfb78a502a4c4cb90a119b70202211f875bc44ee0dca9a1ff07a46d74f85a7c359f477cae0e292185e424317198fe7ad8693482a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
183B

MD5
23a4fd41139e7ecf76c825a215a6afee

SHA1
637bfc7ffe5adabacb6e668b5c9d38c78246ae08

SHA256
fbe75da969d47d1474d5aeb0bccd58e0357fa2d7d6a0eb723035c3bb977c86e8

SHA512
513aad3cf289d24154d14eccf9a5a2892fd019d69f6efd6edf25c9f23308c253d82e6575b3ea3d7e7cfcf53ad4eec264d64c99e993ee2477544b09f2101987cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
443a940cac0aac99ad82f27c3033c2da

SHA1
bb20268d65bc1138e2bf4c2941ddac44485fa4fc

SHA256
e5d81d1dd18f668651be4cce5f517243c237e11066bfefdd7c954247b371b0fb

SHA512
2069c5836967d639f1fd80efad782c26cbdececdfae196dada4df256371963b31e4d3ffd7ee26d1dc8aaf250e06f4718a8f248a9ddbd1d6d23b67564ed90ee10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
00138c861c95df7edf1d8df2c012eea1

SHA1
a7bf3654c77dbf5b38943a31faa0e76c107b6390

SHA256
d83c5c5ed22c4f75ec92e76ecb835643e81313f471b86bb3cfc9711027928e73

SHA512
2bbd2c9920df1d3930fa2cc318895426689ad8f45cdd892d695aa49388df97a364b299ad1679af9b7c67b7939b1057f923eb7b349ed8a03fcdac18a634d5a774

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f86ebee81fbfff09c9a41347cbe1f827

SHA1
c99e17b4a3ae62eb58a408ead67d0d0bab33f56f

SHA256
2ff85506875e8a966376ace3f43679cb57d4385ed62bec0cb31bfd8e2b888e28

SHA512
4abd762f050cbb405054153600491634a8873854e82964705b3721210f22b051fdc1c5b633b60a093e84bd38ad829287dc8e7b10be203e184c7adca1995ccc63

Download Submit