6692f71e72b2134132a3dbb85a44caab9fdc5efaf94bb475d706a24b1d5f5f22

Analysis

max time kernel
146s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73aad581e7edd0cc7aa0dbf44bf4b708_JaffaCakes118.html
Size

4KB
MD5

73aad581e7edd0cc7aa0dbf44bf4b708
SHA1

f660293bd3cfeb45385998c3b1b83f53ceead877
SHA256

6692f71e72b2134132a3dbb85a44caab9fdc5efaf94bb475d706a24b1d5f5f22
SHA512

cf05e673f2851a1ff69cd783e8c8ecdf6d93347cd3d65bbfbf57e01233c02b29f05f744be830d8b3fe0f609d1ef960a4dc2b2a7d6330401f383f70ef2ac15314
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oxlS6d:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
588	msedge.exe
588	msedge.exe
3032	msedge.exe
3032	msedge.exe
1680	identity_helper.exe
1680	identity_helper.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2672	3032	msedge.exe	82
PID 3032 wrote to memory of 2672	3032	msedge.exe	82
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 1724	3032	msedge.exe	83
PID 3032 wrote to memory of 588	3032	msedge.exe	84
PID 3032 wrote to memory of 588	3032	msedge.exe	84
PID 3032 wrote to memory of 4704	3032	msedge.exe	85
PID 3032 wrote to memory of 4704	3032	msedge.exe	85
PID 3032 wrote to memory of 4704	3032	msedge.exe	85
PID 3032 wrote to memory of 4704	3032	msedge.exe	85
PID 3032 wrote to memory of 4704	3032	msedge.exe	85
PID 3032 wrote to memory of 4704	3032	msedge.exe	85
PID 3032 wrote to memory of 4704	3032	msedge.exe	85
PID 3032 wrote to memory of 4704	3032	msedge.exe	85
PID 3032 wrote to memory of 4704	3032	msedge.exe	85
PID 3032 wrote to memory of 4704	3032	msedge.exe	85
PID 3032 wrote to memory of 4704	3032	msedge.exe	85
PID 3032 wrote to memory of 4704	3032	msedge.exe	85
PID 3032 wrote to memory of 4704	3032	msedge.exe	85
PID 3032 wrote to memory of 4704	3032	msedge.exe	85
PID 3032 wrote to memory of 4704	3032	msedge.exe	85
PID 3032 wrote to memory of 4704	3032	msedge.exe	85
PID 3032 wrote to memory of 4704	3032	msedge.exe	85
PID 3032 wrote to memory of 4704	3032	msedge.exe	85
PID 3032 wrote to memory of 4704	3032	msedge.exe	85
PID 3032 wrote to memory of 4704	3032	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\73aad581e7edd0cc7aa0dbf44bf4b708_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc074f46f8,0x7ffc074f4708,0x7ffc074f4718
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17909569126142595874,15480008906494886851,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,17909569126142595874,15480008906494886851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,17909569126142595874,15480008906494886851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17909569126142595874,15480008906494886851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17909569126142595874,15480008906494886851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17909569126142595874,15480008906494886851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17909569126142595874,15480008906494886851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17909569126142595874,15480008906494886851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17909569126142595874,15480008906494886851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17909569126142595874,15480008906494886851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17909569126142595874,15480008906494886851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17909569126142595874,15480008906494886851,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7ae18c17-fa16-44dc-afbb-70d7f31fb29b.tmp

Filesize
11KB

MD5
e43dcd75e33d5547c8fd17bdfb888fa9

SHA1
c6f2dc3a0d17427d95fea6b63b1158e622668964

SHA256
3579bc2e8c84a7747534d20294cc82ce135e440eb1c48fff37ee9ef6315ab7f4

SHA512
9d8c922ae448639482f48ec9323962984148b568d6df438ef2a1936f418848e73ff34f78a0913a87348592d1a4c69992337b744c6345b1d936b05b62b3cd8626

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
024ea358dd766e20eb62477429b2271c

SHA1
3e5020c5fca14add1a45713cf175c693b124dc5d

SHA256
34cd3af6ec22186e8aa306801d2e861e7dfa725de0344aab7ae580be89fef278

SHA512
1a998945a5588a985f0872e3c4c6d3ace758f469b99c104bfd890e17a696017bcea8531be38d3bbbd1244e992b0c6f6922db255d3436955fbb320848d82819bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6782c2ee71333a1b164acc709e8b9ff5

SHA1
1c4f0a7a2f7181c003a09f41c5bc2ff8c039d14a

SHA256
bb84565ac510f7a9fd993cbd3c878eaf7d39bdb493a62d4e7aa413a93a7e3d03

SHA512
82d890cf5f8410098f6735a42deb83babea4760976627ae5aa217804f25bca05466ecb045df0d86b229eca75d9adc5119834cca7900c8304a6e188db04088e83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
900962992ee3113a1aacf03d6003d5ad

SHA1
4025b248184c90bda4ce7f417826efc5591f53e2

SHA256
765d62a04473def2e74729449eaf37e48f23f39013e0854c974ec1ea827c79fd

SHA512
a234625f8cd3a9b05c766edc9f294aaf7f869f4d583ef1909d875d75c7eda7d890acdf1f39156f45169a0850dd01852d19cd98be48d00a8819b4ca6b5d1baf92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit