f4a079f34a923b32c579837fa7f419b51a6905a2eb73651a470bf25a72ad0597

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6edab9993e48e26025fa89478899d3ef_JaffaCakes118.html
Size

52KB
MD5

6edab9993e48e26025fa89478899d3ef
SHA1

6f066c6d1638faf0ad7aedca9748d2ce428cbade
SHA256

f4a079f34a923b32c579837fa7f419b51a6905a2eb73651a470bf25a72ad0597
SHA512

9ff224ae33ea6f1de3846fb106c34921e7cdecbdca0c174cbe4381bc82b7651bb46c21b89764bad629d3e5e94f02354d624effa08e070e3233e32b9687186f08
SSDEEP

1536:Ab3zZ6Oe5n0ghNxgefN3MU39DMglNJfXwJ0:68Oe50geefR9Dt+J0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{AD53E2CE-78EE-4713-A1AE-51C4FA0C0A83}	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1016	3028	msedge.exe	105
PID 3028 wrote to memory of 1016	3028	msedge.exe	105
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 2176	3028	msedge.exe	106
PID 3028 wrote to memory of 1724	3028	msedge.exe	107
PID 3028 wrote to memory of 1724	3028	msedge.exe	107
PID 3028 wrote to memory of 228	3028	msedge.exe	108
PID 3028 wrote to memory of 228	3028	msedge.exe	108
PID 3028 wrote to memory of 228	3028	msedge.exe	108
PID 3028 wrote to memory of 228	3028	msedge.exe	108
PID 3028 wrote to memory of 228	3028	msedge.exe	108
PID 3028 wrote to memory of 228	3028	msedge.exe	108
PID 3028 wrote to memory of 228	3028	msedge.exe	108
PID 3028 wrote to memory of 228	3028	msedge.exe	108
PID 3028 wrote to memory of 228	3028	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6edab9993e48e26025fa89478899d3ef_JaffaCakes118.html
1⤵
PID:3892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4836 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:1
1⤵
PID:2104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=3636 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:1
1⤵
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5468 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:1
1⤵
PID:2196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5056 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5520 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffe57e72e98,0x7ffe57e72ea4,0x7ffe57e72eb0
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2284 --field-trial-handle=2288,i,5610514392257780037,9832590235243164785,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2320 --field-trial-handle=2288,i,5610514392257780037,9832590235243164785,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2496 --field-trial-handle=2288,i,5610514392257780037,9832590235243164785,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4392 --field-trial-handle=2288,i,5610514392257780037,9832590235243164785,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4392 --field-trial-handle=2288,i,5610514392257780037,9832590235243164785,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4444 --field-trial-handle=2288,i,5610514392257780037,9832590235243164785,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4404 --field-trial-handle=2288,i,5610514392257780037,9832590235243164785,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4448 --field-trial-handle=2288,i,5610514392257780037,9832590235243164785,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
debf331da6a2a0368f637c5fc2ad669f

SHA1
327cb2066733c6c1b1dcce06e6e17985bcf35476

SHA256
9d26f132006ff902a8ceaca36aa6ade848fe005a257fd1022746d62bd102e1ae

SHA512
c63233b279b39f7a828b063eb03fc73cc551828cdf68f40a5d94758ab2dd7dd2ff64262e32fff6e8b6a09bc8a559737c40eb31b7b5f79e07cb2250158f0ea145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
c2182e8d563ef1ec306526ddeadbbc5e

SHA1
2c923cb013c77be9f662f86a461a988ebdeedb3b

SHA256
61e02420099a2e7e45743f12ed709a90c5c482d949bdea855ff844b08f729b35

SHA512
c5b86b43d5829e8be166c2b246c226bcdf9cd0cd65a5c2c250cfd3ea58b9c0d0123b624b31c5146ee83b51d7865e23c2ace39936087184813b15492299087666

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
30KB

MD5
658587cb6df17e7679c388f5ef3d1bb9

SHA1
e35c46030fed23e7a83b8916d45dde971b11bed0

SHA256
94fd63e32c90ce8ef8278a4b05cc37832edf42cbc6419272ac20a8cf450c94ec

SHA512
79daf62ae352f969ded58ab404f3afd549c836a16d497a371b17e69ce9a70a3cd05387fa7011117ee09cf4e8843b3ad1af94beb56477ea8fd33021c97959cc4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
66KB

MD5
3c134456f25a265dae527652557e8950

SHA1
d5ba3874c1b055d6a6ceec96791e9d3d04ba13de

SHA256
8a5739e1ff213d159b95b5e515b7fda6ab0f07f008b0f43b48ff7ecac72bd3e8

SHA512
67d55efa614ee146c20bf35f6b3d67233ac59ef8ec46ff857ac2153a4bd00e2e4c3d9a55b944e8e352fb391e12cc91956ef84f0b90fcbe37b2699c659683b047

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
56KB

MD5
41778399c9f8de0b1be9dedf2039d121

SHA1
8cb9142cc588d01df011fcb1b73f982d71c071ff

SHA256
bee5f3fd731b5db0aa6158285b7571a6978deb2a7d3e3d9d74c7d86bfdab1df2

SHA512
043dc595d941a7f4a7ae07705af984ec56baba009dbd01a464fc7edae8d4673fe669d522e800cfd2efad4102576e14d4caab231355684c136911727f82f108d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
fb79792e8832ba1a47c31bce954cbbb6

SHA1
bc75065d93eafb346e5e948c5b692d3af9eb0c1c

SHA256
782146c77a9fea75219f17833b66173a77280cf4e647367240d3cc88676d4f91

SHA512
88936a2b58b046c49e335271a2bacce975e4b473c9a5328b67457c916b3edbe79f31aa9860bb660401c1a3ee309d2144febb3e770faa819f099282c2b9a58096

Download Submit