7ce2ed4cc7a6cb44a606ffcc8bb26ead00947d589f816816d5e95d82e75347f0

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70972359d9e82ef829f4a2af10d7f411_JaffaCakes118.html
Size

21KB
MD5

70972359d9e82ef829f4a2af10d7f411
SHA1

d75939230de18e5f404e20735b65b3d64d4bb946
SHA256

7ce2ed4cc7a6cb44a606ffcc8bb26ead00947d589f816816d5e95d82e75347f0
SHA512

0b9a9ad8509836ab79a0650dda9990acbf119765dc15be96ab96af60cb17c28544b87a1997f1cc9c238802ba4467e4d03633e0dd551391e372aeb9d2946a467e
SSDEEP

384:zrbTBiEVf6jIBJqugqi3UWXHU3cQfXzEI4MM1fU7:vcZjIHRg13UWXwwIs1E

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
4604	msedge.exe
4604	msedge.exe
1992	identity_helper.exe
1992	identity_helper.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 4196	4604	msedge.exe	83
PID 4604 wrote to memory of 4196	4604	msedge.exe	83
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 2940	4604	msedge.exe	84
PID 4604 wrote to memory of 3904	4604	msedge.exe	85
PID 4604 wrote to memory of 3904	4604	msedge.exe	85
PID 4604 wrote to memory of 640	4604	msedge.exe	86
PID 4604 wrote to memory of 640	4604	msedge.exe	86
PID 4604 wrote to memory of 640	4604	msedge.exe	86
PID 4604 wrote to memory of 640	4604	msedge.exe	86
PID 4604 wrote to memory of 640	4604	msedge.exe	86
PID 4604 wrote to memory of 640	4604	msedge.exe	86
PID 4604 wrote to memory of 640	4604	msedge.exe	86
PID 4604 wrote to memory of 640	4604	msedge.exe	86
PID 4604 wrote to memory of 640	4604	msedge.exe	86
PID 4604 wrote to memory of 640	4604	msedge.exe	86
PID 4604 wrote to memory of 640	4604	msedge.exe	86
PID 4604 wrote to memory of 640	4604	msedge.exe	86
PID 4604 wrote to memory of 640	4604	msedge.exe	86
PID 4604 wrote to memory of 640	4604	msedge.exe	86
PID 4604 wrote to memory of 640	4604	msedge.exe	86
PID 4604 wrote to memory of 640	4604	msedge.exe	86
PID 4604 wrote to memory of 640	4604	msedge.exe	86
PID 4604 wrote to memory of 640	4604	msedge.exe	86
PID 4604 wrote to memory of 640	4604	msedge.exe	86
PID 4604 wrote to memory of 640	4604	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\70972359d9e82ef829f4a2af10d7f411_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6fe746f8,0x7ffd6fe74708,0x7ffd6fe74718
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6933927582751450056,2281240768784596803,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,6933927582751450056,2281240768784596803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,6933927582751450056,2281240768784596803,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6933927582751450056,2281240768784596803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6933927582751450056,2281240768784596803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,6933927582751450056,2281240768784596803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,6933927582751450056,2281240768784596803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6933927582751450056,2281240768784596803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6933927582751450056,2281240768784596803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6933927582751450056,2281240768784596803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6933927582751450056,2281240768784596803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6933927582751450056,2281240768784596803,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
655B

MD5
153abe86f32b5e9330f402a67942afc4

SHA1
19ba7f8e3337d02a6efd11ad2e9bd14f83ca4f7c

SHA256
a9edb298e222aee4668a186e3dd0684155679c85c4a015c4808424762a3d0f15

SHA512
ee9dce07f071e1be46f38545e49eb0b4db4e7002569f2e14b905f1ebdf50a13f999bfa4923ad9e840a4566fbec66a766c511a6320650be633d2affe2bd3700c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c4c0cabd91d9a61c0d78d0c17f12afc6

SHA1
b6b1b467be7675da91f6ef042229548102003bb0

SHA256
0aa3f5e2082fd1112f7fdf9d26c07afeacdc90584c656386cc1de6772d294cab

SHA512
7d9768751cc8cd4826f4bd921663bc1903af16dd432fdf4f4c1a71c50910fb87df0cdafd6bb141faf2cdb14bdd22c85413aa759e75d546f2870ff1c2b4c3922d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a43169c7810772594857ccc89a41f677

SHA1
cad0d13abf0bdae225dc5b4d126578e6786a22c4

SHA256
e658946a6033c434676f883cc23450d6b5fcb98e4f0e363040c1cf6e0ba4d047

SHA512
a49b8a1b14b441987f22595a0d76b844f9d1b7626c57c1cbab98d890f58bd8d0516ab326d16b017b2fc43fdf81e56289d8b5660a8b641c63c51f7bf5547594c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
642e1cc81670bc167ac30fa7235cce9a

SHA1
21ce920cea87edde6ab227f2f540b1f201a8bf16

SHA256
d1358113e68b64b57f503987bf1b4d82f51434a973c4c344f7820a4b25892095

SHA512
933088fc33cf5f2bd35cd63cdda87d4dd37cccd49777fd7025ddbd626f82cf0e36ea74fb89bc1de9847c26a4f300f27aa4ed2a16c0dcb6aaaecd782d37860c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1619a1e6fad1515b5d7605f84d01faba

SHA1
44c063fff6a0ec222d3277cc277288953866eda0

SHA256
016563232aea20c72044729bb8593111abefeb761436c06f404c5695a7cc3b17

SHA512
5ec51aa2820e97ea528e0e5912c0aaf266f9a495ff86c2213fc487303469c2e8421567f8855ec1bf5ad112b6ac8dbcea271e097a6a73c2d37ead859ed00e75f4

Download Submit