139a5375181142f757ded8acb16c766870612ea9b88023fba5fb562300f13e64

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f74a1be0395fd7f44401dcbf2bc4056_JaffaCakes118.html
Size

140KB
MD5

6f74a1be0395fd7f44401dcbf2bc4056
SHA1

28e85333f0f4e5f747fd02bf2f81834ac23f0cf4
SHA256

139a5375181142f757ded8acb16c766870612ea9b88023fba5fb562300f13e64
SHA512

9eec2744535a2816a4b20d9fbc090f80d12809c50a66055eb785ee2aeae08152f65763db19d2f29fb522fe859e38ed4d298b6e81265ee405106366df35775e0f
SSDEEP

768:EljsDVjrgTMD2dCBjUMXPZRaIguDZgNf2:ElVTQaMBRaIrZg0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
3840	msedge.exe
3840	msedge.exe
3136	identity_helper.exe
3136	identity_helper.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 4600	3840	msedge.exe	82
PID 3840 wrote to memory of 4600	3840	msedge.exe	82
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 3340	3840	msedge.exe	85
PID 3840 wrote to memory of 4384	3840	msedge.exe	86
PID 3840 wrote to memory of 4384	3840	msedge.exe	86
PID 3840 wrote to memory of 4984	3840	msedge.exe	87
PID 3840 wrote to memory of 4984	3840	msedge.exe	87
PID 3840 wrote to memory of 4984	3840	msedge.exe	87
PID 3840 wrote to memory of 4984	3840	msedge.exe	87
PID 3840 wrote to memory of 4984	3840	msedge.exe	87
PID 3840 wrote to memory of 4984	3840	msedge.exe	87
PID 3840 wrote to memory of 4984	3840	msedge.exe	87
PID 3840 wrote to memory of 4984	3840	msedge.exe	87
PID 3840 wrote to memory of 4984	3840	msedge.exe	87
PID 3840 wrote to memory of 4984	3840	msedge.exe	87
PID 3840 wrote to memory of 4984	3840	msedge.exe	87
PID 3840 wrote to memory of 4984	3840	msedge.exe	87
PID 3840 wrote to memory of 4984	3840	msedge.exe	87
PID 3840 wrote to memory of 4984	3840	msedge.exe	87
PID 3840 wrote to memory of 4984	3840	msedge.exe	87
PID 3840 wrote to memory of 4984	3840	msedge.exe	87
PID 3840 wrote to memory of 4984	3840	msedge.exe	87
PID 3840 wrote to memory of 4984	3840	msedge.exe	87
PID 3840 wrote to memory of 4984	3840	msedge.exe	87
PID 3840 wrote to memory of 4984	3840	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6f74a1be0395fd7f44401dcbf2bc4056_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc06ac46f8,0x7ffc06ac4708,0x7ffc06ac4718
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11283890912612302012,16848557905250716228,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,11283890912612302012,16848557905250716228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,11283890912612302012,16848557905250716228,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11283890912612302012,16848557905250716228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11283890912612302012,16848557905250716228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,11283890912612302012,16848557905250716228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,11283890912612302012,16848557905250716228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11283890912612302012,16848557905250716228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11283890912612302012,16848557905250716228,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11283890912612302012,16848557905250716228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11283890912612302012,16848557905250716228,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11283890912612302012,16848557905250716228,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
384B

MD5
d08ec669c8694d15c358e7ab6d810b8a

SHA1
399ff50a83f0159962185747d3c6e6ce0c486fee

SHA256
8dabdfe64363809a1b40a5977fa4e050d83d6855e64984b657d80d8ce8298332

SHA512
dbc624b1f8de8f92813059868902e8869bca8b17aeed5eb59b2041e18b57003c13cce042eb74dab737ed45d6929b7b363d64192900a266586178cbd7846eeb92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
436d8ede20f0009547535956a55f33ab

SHA1
e85a346753c9e88018784fa965dd3a35317fa875

SHA256
c249f1fc15a95f2fdbc6b06fe630dbd832430f511f54cd86082ddd7603db066b

SHA512
89d265d3c8ab3cd030d05be96f0cb0708d90880a99668edf04a4ed22f8e77d1c38a770101765cde6d7b8df702569a0b974a670093a5648036ed1913fc4434cca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3802d7fd1abed536aeb5d1d0cde2a09b

SHA1
ac38f9853623c2a41b204f75e14fa298ccf8940c

SHA256
28ab7a02cbc1d2c24cb91015fd3ac306bd12993314921ee5bad675d33e7d6b80

SHA512
eb734017705ee82f1fcae9b2a4f93ae288405af67011e2dbfae49a0c9a8e85942e8faf2a330424410fbff8d92d67a35e3db7c426e9f5b09111f0075f6428e4b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
325e77bbd86577f0f75e3b9aec3f0f9a

SHA1
9fdf47e854eceae30fdacb49a03f7edfdfc393c8

SHA256
ecfac87cf2155d924b9746ad809ef4763c89dd17407fb87977dc7da875f14337

SHA512
06f9fb5e258f32c1abdb99d6b68cbb92ba23ae0afad7d43f84d14f953104cf06df09f5efa32da8cde5ad5584ad01266234c73fe462fa4641fe71b3dc37cb7da6

Download Submit