8d20293290672ab103113eb1a590ca1351a5ba73b53304dd7d16638668065196

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e9cdc0bc11872c662485dbb61473883_JaffaCakes118.html
Size

42KB
MD5

6e9cdc0bc11872c662485dbb61473883
SHA1

491ddd16b4f0d6bce7916d1613d49e56772eacdd
SHA256

8d20293290672ab103113eb1a590ca1351a5ba73b53304dd7d16638668065196
SHA512

82b7f3ef9d532dfc597cbfceb33c15f31ac0a3bb12c543a338ac328a4055e3ffb13e80ae1b1dc11f455223d24ed80b2cf6a17db6e4f3b2e5f7d0071d0b9f66cf
SSDEEP

384:IZCx32Kv8dSDu/G1THSG7dfiLcujY0+FUUU6r7S+W3l4VRp5GqMHoLlTgCxu2G:8KkdSVTHziQuAr7Swd5GqMHYlTgCXG

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
3056	msedge.exe
3056	msedge.exe
3208	identity_helper.exe
3208	identity_helper.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1932	3056	msedge.exe	82
PID 3056 wrote to memory of 1932	3056	msedge.exe	82
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3220	3056	msedge.exe	83
PID 3056 wrote to memory of 3276	3056	msedge.exe	84
PID 3056 wrote to memory of 3276	3056	msedge.exe	84
PID 3056 wrote to memory of 2232	3056	msedge.exe	85
PID 3056 wrote to memory of 2232	3056	msedge.exe	85
PID 3056 wrote to memory of 2232	3056	msedge.exe	85
PID 3056 wrote to memory of 2232	3056	msedge.exe	85
PID 3056 wrote to memory of 2232	3056	msedge.exe	85
PID 3056 wrote to memory of 2232	3056	msedge.exe	85
PID 3056 wrote to memory of 2232	3056	msedge.exe	85
PID 3056 wrote to memory of 2232	3056	msedge.exe	85
PID 3056 wrote to memory of 2232	3056	msedge.exe	85
PID 3056 wrote to memory of 2232	3056	msedge.exe	85
PID 3056 wrote to memory of 2232	3056	msedge.exe	85
PID 3056 wrote to memory of 2232	3056	msedge.exe	85
PID 3056 wrote to memory of 2232	3056	msedge.exe	85
PID 3056 wrote to memory of 2232	3056	msedge.exe	85
PID 3056 wrote to memory of 2232	3056	msedge.exe	85
PID 3056 wrote to memory of 2232	3056	msedge.exe	85
PID 3056 wrote to memory of 2232	3056	msedge.exe	85
PID 3056 wrote to memory of 2232	3056	msedge.exe	85
PID 3056 wrote to memory of 2232	3056	msedge.exe	85
PID 3056 wrote to memory of 2232	3056	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6e9cdc0bc11872c662485dbb61473883_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab30c46f8,0x7ffab30c4708,0x7ffab30c4718
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,12271453449486322734,8863816298193285190,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,12271453449486322734,8863816298193285190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,12271453449486322734,8863816298193285190,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12271453449486322734,8863816298193285190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12271453449486322734,8863816298193285190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,12271453449486322734,8863816298193285190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,12271453449486322734,8863816298193285190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12271453449486322734,8863816298193285190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12271453449486322734,8863816298193285190,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12271453449486322734,8863816298193285190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12271453449486322734,8863816298193285190,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,12271453449486322734,8863816298193285190,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4aa6db2f7542b91a74520224a68d627a

SHA1
798e8e2aa7b001e2e85c13a59b1a02a64b2b66fe

SHA256
0f4faa298637968ac4c8ab5dec7af66a1f1c3329ff8570d03fb2e59761f5a2e4

SHA512
dcae4386f993ee5bd599c892d4a583f575b3d5a8cb4724d2d9a431bc33e58f25396904c7ff542c984d5262044b214e567d4188b2576af28c2e385e82002e3689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df75b3f2a2ce7705562d4befb70fae9c

SHA1
c2095078db6d4aa3713fa2b3bd87cb3b1495b149

SHA256
7e8385c207fe3c5bc8cb9a22c1fb93a8d286301ad7c06016e5e3f47e7d543244

SHA512
e6e53f1cc185cb869afec28433ec34b295947485fb44a94faee73e74791f3c48d47b6d0c790794adcddc52ce10f5705cff4e669100a9483550cd02bf102365f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
05f898e1f4fe94dea395e25c444af536

SHA1
c01eda501ccee5eb34f0410ae61c654fe60a0373

SHA256
5af0e5beee33881e8db661b5ed95d7417272e09b69959f580f579aa49b050fda

SHA512
cfbc2d74b9984e37c333c4fcaadb64d357b2127198aa2c0f10d534dcb1983c036224ec5fb964748d8ced6748aacaf9d0101c0ed1e671d8e2cfc4d3eaa627ebb6

Download Submit