a86509d225329069341a75d1f9cc8aa727e93977805270ab6159bb8882f45d74

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f2d64c0d50c17f7646bba4acf13f1eb_JaffaCakes118.html
Size

59KB
MD5

6f2d64c0d50c17f7646bba4acf13f1eb
SHA1

d09053276a0ce6b0659b5f77cbafc76c2ca6ccd6
SHA256

a86509d225329069341a75d1f9cc8aa727e93977805270ab6159bb8882f45d74
SHA512

58a9d08de6552ee28bed98152e7e3583cd15d00daaf6b4be30c95da801a89bcd069001a0636d6128cf0deda13a402be0ca823f4c9c4f96c12545a42c8671a822
SSDEEP

768:AKPfPgVMBAr4rteg40/er6W5lvQUDOLe1cpsZ92SJW:FnPgVMBAr4rte9+e+6lvHOLe+psZg

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3832	msedge.exe
3832	msedge.exe
1188	identity_helper.exe
1188	identity_helper.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 2084	3832	msedge.exe	82
PID 3832 wrote to memory of 2084	3832	msedge.exe	82
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 4748	3832	msedge.exe	83
PID 3832 wrote to memory of 3500	3832	msedge.exe	84
PID 3832 wrote to memory of 3500	3832	msedge.exe	84
PID 3832 wrote to memory of 4828	3832	msedge.exe	85
PID 3832 wrote to memory of 4828	3832	msedge.exe	85
PID 3832 wrote to memory of 4828	3832	msedge.exe	85
PID 3832 wrote to memory of 4828	3832	msedge.exe	85
PID 3832 wrote to memory of 4828	3832	msedge.exe	85
PID 3832 wrote to memory of 4828	3832	msedge.exe	85
PID 3832 wrote to memory of 4828	3832	msedge.exe	85
PID 3832 wrote to memory of 4828	3832	msedge.exe	85
PID 3832 wrote to memory of 4828	3832	msedge.exe	85
PID 3832 wrote to memory of 4828	3832	msedge.exe	85
PID 3832 wrote to memory of 4828	3832	msedge.exe	85
PID 3832 wrote to memory of 4828	3832	msedge.exe	85
PID 3832 wrote to memory of 4828	3832	msedge.exe	85
PID 3832 wrote to memory of 4828	3832	msedge.exe	85
PID 3832 wrote to memory of 4828	3832	msedge.exe	85
PID 3832 wrote to memory of 4828	3832	msedge.exe	85
PID 3832 wrote to memory of 4828	3832	msedge.exe	85
PID 3832 wrote to memory of 4828	3832	msedge.exe	85
PID 3832 wrote to memory of 4828	3832	msedge.exe	85
PID 3832 wrote to memory of 4828	3832	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6f2d64c0d50c17f7646bba4acf13f1eb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff561b46f8,0x7fff561b4708,0x7fff561b4718
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,12419530414007863432,5896728909910775018,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,12419530414007863432,5896728909910775018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,12419530414007863432,5896728909910775018,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,12419530414007863432,5896728909910775018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,12419530414007863432,5896728909910775018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,12419530414007863432,5896728909910775018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,12419530414007863432,5896728909910775018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,12419530414007863432,5896728909910775018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,12419530414007863432,5896728909910775018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,12419530414007863432,5896728909910775018,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,12419530414007863432,5896728909910775018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,12419530414007863432,5896728909910775018,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,12419530414007863432,5896728909910775018,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5412 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
19223435da89330b984abc6a069789a8

SHA1
f9f17681ba5f924e6dd0cea988725676f6fb6c77

SHA256
3af423186eda7ab71e6834551a41f6ee3901d472dccd04ca0a29c6b11fd4d1e1

SHA512
3234fb4e13274135b90e2c2c1506d18375cbe0d3054a70d71d4ac56e3d9c3f97bc9bf63f016389b1b443840df40cad23429fe930bf564282c8e8caf18f29f931

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
995043c9c45036ad7a33f7cddc49f521

SHA1
ab9aec035003930d4930bbda5a9a4682c9fabccb

SHA256
ac72e973255e4780b5dfe0f5c5e45c5bd7e20516c57a5f825709006ed5e74b15

SHA512
e9b5be834f3b86050da73b8e2854007f36ed3ed24245a520e0d50d7de54ca1c87b42125468f2b722a7edbd744cc838c339d29a3f71267a708e31bb0fd77d2c23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1473bfbe319c6fc2b174432ea53cc6de

SHA1
8765508e5896d194b9f69aa9a3446490de5b2998

SHA256
14c2e38c5ff7ca701e913e5065bc4b9602c9c49ea19304145a25682ebfc68912

SHA512
29b39d30d80cf3bc55d231608f7152819598551e4427a8d00df5e1dd8ce735ed909f185eb02948489c9db08cb3916de417832e9bdc740b39be89eab06cb2211f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
66f6f82df533cbe6acd732a741a5ed84

SHA1
efaa3e49973ed3fb7fcd62300fba23e6ad21c2a6

SHA256
f117463e9b6e22232d5e08b178672c356b6402c968cac0834d8874b446ba492a

SHA512
f624e643f7708d323a2c9eebc1d0517025768db89da8979cdc2f4fd323c546c3b6bc41251a97639dc6773db4785a88bc797a6d51ddfe38a21e648dcee508b632

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5e39407110cfa0254761c83abe5729a3

SHA1
83aaca02b36813ee0105d5cb1f9ea9eea908b227

SHA256
9f05bb24c25916a9999d5c6597bfd330acff119996f6335b637a3f0486052443

SHA512
8e60d94b8b29892a6be1214fa1b3f5a3637e4c869fe1bd1264395868cc3c2ad3349d26a351f290e34243c7c70a6b05198daa71bb101c4926fd992cc82f6f04f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
91a8f00a0d531b6e7d185fa8e88422d7

SHA1
4b78911e6fb60f432295311bb09c9aa1862944bc

SHA256
84513214e3f03c75e3c0815e234f86060dfcf2765b4556559a4b69d61be5b606

SHA512
b9f190777eb6c3aeaa2a1fd1b5239283a72086588bc63f83edf533e4a99dd6fe5f4a0dddc2455ed60bd5ed05ec17da738e15dc16b82f9b7d8429d632fcf0d3b7

Download Submit