88b8fb713b7e4455c2fbdc1e88b118470895e502793aab2dc913f2c60f4eaa1d

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6edfc1a6f9d92b91b9d74ba5a8391210_JaffaCakes118.html
Size

23KB
MD5

6edfc1a6f9d92b91b9d74ba5a8391210
SHA1

98a00d93b2b453418caa76edb4bcf889e9ccf2e6
SHA256

88b8fb713b7e4455c2fbdc1e88b118470895e502793aab2dc913f2c60f4eaa1d
SHA512

48ed2e1c733eab0b1a01539d928139da68eba4d3712bf6c24cfc3411d449ee5f494dbe884dd90e932c89747057343032a7295159be92ec1cfc9f206e582e0dd3
SSDEEP

192:uwPIb5naGnQjxn5Q/RnQiecNnJnQOkEntDDnQTbnRnQXGLnLnQtKqMB8qnYnQ7tA:LQ/JGj+j

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
5076	msedge.exe
5076	msedge.exe
1536	identity_helper.exe
1536	identity_helper.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 984	5076	msedge.exe	82
PID 5076 wrote to memory of 984	5076	msedge.exe	82
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 1416	5076	msedge.exe	83
PID 5076 wrote to memory of 3948	5076	msedge.exe	84
PID 5076 wrote to memory of 3948	5076	msedge.exe	84
PID 5076 wrote to memory of 3960	5076	msedge.exe	85
PID 5076 wrote to memory of 3960	5076	msedge.exe	85
PID 5076 wrote to memory of 3960	5076	msedge.exe	85
PID 5076 wrote to memory of 3960	5076	msedge.exe	85
PID 5076 wrote to memory of 3960	5076	msedge.exe	85
PID 5076 wrote to memory of 3960	5076	msedge.exe	85
PID 5076 wrote to memory of 3960	5076	msedge.exe	85
PID 5076 wrote to memory of 3960	5076	msedge.exe	85
PID 5076 wrote to memory of 3960	5076	msedge.exe	85
PID 5076 wrote to memory of 3960	5076	msedge.exe	85
PID 5076 wrote to memory of 3960	5076	msedge.exe	85
PID 5076 wrote to memory of 3960	5076	msedge.exe	85
PID 5076 wrote to memory of 3960	5076	msedge.exe	85
PID 5076 wrote to memory of 3960	5076	msedge.exe	85
PID 5076 wrote to memory of 3960	5076	msedge.exe	85
PID 5076 wrote to memory of 3960	5076	msedge.exe	85
PID 5076 wrote to memory of 3960	5076	msedge.exe	85
PID 5076 wrote to memory of 3960	5076	msedge.exe	85
PID 5076 wrote to memory of 3960	5076	msedge.exe	85
PID 5076 wrote to memory of 3960	5076	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6edfc1a6f9d92b91b9d74ba5a8391210_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xd8,0x104,0xdc,0x108,0x7ffdd00f46f8,0x7ffdd00f4708,0x7ffdd00f4718
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16323253492923928716,11199594232066130942,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,16323253492923928716,11199594232066130942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,16323253492923928716,11199594232066130942,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16323253492923928716,11199594232066130942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16323253492923928716,11199594232066130942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16323253492923928716,11199594232066130942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16323253492923928716,11199594232066130942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16323253492923928716,11199594232066130942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16323253492923928716,11199594232066130942,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16323253492923928716,11199594232066130942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16323253492923928716,11199594232066130942,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16323253492923928716,11199594232066130942,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
90df7783a33aa311f276ceec9cc0d840

SHA1
5f096222a9693b0e2a5ce92d4ad5c784fb0521c2

SHA256
9cee2daa9cf25e30258da035edaa999f1c32037ee4fd7dafc4a39f76ed8fae77

SHA512
8c8f5a23cd0464494f5e5c3d6dfcc1a5f08a2aa52735b9ce2a7695c7bde5052aa5dffc14acd5649a7d673e05776d8d8af5984544a36eec3486f7811d7ce8315e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9dde3904f800261d760d1b4a10e52474

SHA1
0778de728852c2a88004a7c5050a4c96ca78c8fc

SHA256
04a52758acbdbb343e801ea2d196870fa0bd81649aa781c957b4a25306941f98

SHA512
0349ba350d3bbbd97b879c6ab72388144002e3f96433509041212a4134a46965f212c944ca037751d21c27a0cd128db84ad925c8ca544f241ccdf30fa0d505ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6c3c27fdf30f2dd27b5ffd1ad1532114

SHA1
d4dbc28638be75c7334821654b607fb911173569

SHA256
4d60216d1f461d003022cc265470cde5d985a97086d6c09e7bc120a1ce77086c

SHA512
efed5f0403eed69d8de6ac1433ff4098fb74320fb025cbc1881f04babdaa61772a4e30eca461d6a99f265bf2faa5a9ac1cff36f93a5c1e3d84892915a06a68c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fd76afe6fc4de60d9144c9dfaa38e113

SHA1
8f013b31130d9015e3e58a0c2ba22179ce8cee22

SHA256
b90b3830aecaf3e33f7b357b969a1b89fcc5d2e0f9f451c3dff54f3dd6b70b75

SHA512
3405e78ea85027ce6ea6df8c10d6c0a0fd67118c60537cbab878506b31db54e6b9b6db77f71154dd225084c4a691e87367cfed37f11b41398f593e4ad71b9b47

Download Submit