051a0384e51b3466ac4223bce227d56bcdbc90e4ab2248708a640ae1e4e7bccb

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f9eb5ebfd75f77b9f724122ee0a7394_JaffaCakes118.html
Size

101KB
MD5

6f9eb5ebfd75f77b9f724122ee0a7394
SHA1

97f671bc885cecaa8c05f022cdb2db4c5614c3ab
SHA256

051a0384e51b3466ac4223bce227d56bcdbc90e4ab2248708a640ae1e4e7bccb
SHA512

91a738a9272dcf5a65df0e286b12c05b7f4d05e8efc0e86ed3f2172522ee7cc11fe852b6fa5d65145f846b752231e4a94a2cbda1432872abb100e5a02acde5ea
SSDEEP

3072:f/QTjHipKVPGbvpfT3lwNrCZu+XBgb5SHtTRF:f/QTjHipKVT9m

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
4272	msedge.exe
4272	msedge.exe
4632	identity_helper.exe
4632	identity_helper.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 4700	4272	msedge.exe	83
PID 4272 wrote to memory of 4700	4272	msedge.exe	83
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 2104	4272	msedge.exe	85
PID 4272 wrote to memory of 2104	4272	msedge.exe	85
PID 4272 wrote to memory of 2972	4272	msedge.exe	86
PID 4272 wrote to memory of 2972	4272	msedge.exe	86
PID 4272 wrote to memory of 2972	4272	msedge.exe	86
PID 4272 wrote to memory of 2972	4272	msedge.exe	86
PID 4272 wrote to memory of 2972	4272	msedge.exe	86
PID 4272 wrote to memory of 2972	4272	msedge.exe	86
PID 4272 wrote to memory of 2972	4272	msedge.exe	86
PID 4272 wrote to memory of 2972	4272	msedge.exe	86
PID 4272 wrote to memory of 2972	4272	msedge.exe	86
PID 4272 wrote to memory of 2972	4272	msedge.exe	86
PID 4272 wrote to memory of 2972	4272	msedge.exe	86
PID 4272 wrote to memory of 2972	4272	msedge.exe	86
PID 4272 wrote to memory of 2972	4272	msedge.exe	86
PID 4272 wrote to memory of 2972	4272	msedge.exe	86
PID 4272 wrote to memory of 2972	4272	msedge.exe	86
PID 4272 wrote to memory of 2972	4272	msedge.exe	86
PID 4272 wrote to memory of 2972	4272	msedge.exe	86
PID 4272 wrote to memory of 2972	4272	msedge.exe	86
PID 4272 wrote to memory of 2972	4272	msedge.exe	86
PID 4272 wrote to memory of 2972	4272	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6f9eb5ebfd75f77b9f724122ee0a7394_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffa3ad546f8,0x7ffa3ad54708,0x7ffa3ad54718
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,15367708132546669496,10113701555777490474,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,15367708132546669496,10113701555777490474,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,15367708132546669496,10113701555777490474,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15367708132546669496,10113701555777490474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15367708132546669496,10113701555777490474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15367708132546669496,10113701555777490474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,15367708132546669496,10113701555777490474,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,15367708132546669496,10113701555777490474,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15367708132546669496,10113701555777490474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15367708132546669496,10113701555777490474,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15367708132546669496,10113701555777490474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15367708132546669496,10113701555777490474,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,15367708132546669496,10113701555777490474,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
6b75de02ef8e417f4ab4b208dc3a49f0

SHA1
51a1f9650ff45eac0ef79224af6d6633b458dd83

SHA256
8f9e1c7009d16d821f09d80c301e409eed62d07e88f83ba14720f3b5c4ccf503

SHA512
e5a578fc97cef8cd65611fffe0c01f3b03e4f6e17062a0f49ae991e08dab87d2fc33d8a86081c02ce00a66e4390f2a873ebc7fbe2766d309ae6e92873467eaf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
821B

MD5
63eb71c827b501dd013c7a5ccff2c02f

SHA1
e1a51cc8dcb97db6368d9e286a919f9eff32b554

SHA256
b2fccfc6ac6918d1f79fafd85aa757e4f45c672b9ec36ec2b10d9cc589718a69

SHA512
d7eb1c568cfd07ad4711687d64d9b771dc0720ff62a2f379ff07ac6fdca9432b7e4d72fab238c0f59512abc1db6e6824edd6bc2e4568d8a517a24467f3cb6db3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0d93822d6fbb94c5bfcae02ede96be36

SHA1
662e71159aa2379f31ea22121d0bca95f03a1f35

SHA256
dd60b8eef0f302d5c5ffb35b38cf9d920185977f2aa5ac92c4526c185a132a2e

SHA512
d9f147630b90dcc77a3015b1f6abee279ce762e1c51a43ca742d574681255d8567def8700a4a83b1817312421edcae77011864c3e8be4be3166fcf9f64d1b78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
33b9ed2f83012ca998b22b994affee93

SHA1
bb6a569150f6a5e2f61512ba8b7939b9ddac3370

SHA256
aea6d5122723547e84251c66ae057592a2d4e06842589af80c8ecabe0c3b1fe6

SHA512
37fd6da1534de637a9154e9e4c526dfae7ad366ea02be205608f87fbff6fb004c224b387b0d4f256728539ea33e54abcb72d9b72d111b025db1ab66edf7de792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0cb6397b484ccdb5b7ff67dfc3f4ff79

SHA1
0482a1cc7f2a7860be8d5b638a9d88217ab6064d

SHA256
fd26f4e6edcfe28a78488f9a5e1b31fe4a404488c746cff28fb6b5a280129e14

SHA512
47d0ecb13b8ccfdf7ffe3d5700c648ce3597b0196217be0c3b87fd0dd6c14112cb74c42e5d0ea5e8d9ef064d776ca0efd2f3f1ac08cd13c9b14979b0caa5f2cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e0122f9c5648b55af5234cda86eaab45

SHA1
e9e964d8e09633f52083f9b926e7562eb3680ed4

SHA256
01a1dd7b56abd42b30caf2addf0a64b108673c67188990d2042e67e70187f56e

SHA512
ad50cd210ab64fea571d8f8faddf0f0d8a99074d9e0e3f7163682b77a7387b4af9cd7895e9f15a545a5b7f5cd0461932f16e3eed2da4dbc6274d4bfabb26b3bd

Download Submit