86004daa54f60b8dcac204ffa529d50eff21411b874d96b1fca85ce73cf32ce7

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

786cc6f7a7d19cc1578f96d4d2522922_JaffaCakes118.html
Size

14KB
MD5

786cc6f7a7d19cc1578f96d4d2522922
SHA1

dc14fa5e7060f76d71ba02c031fcf533b3b8fd55
SHA256

86004daa54f60b8dcac204ffa529d50eff21411b874d96b1fca85ce73cf32ce7
SHA512

96751d3441d3f7ebb1abee158e957c69effceb9a841003a55c0f754ec3307e833b236a1fcb356e6ce6f9ddaabf295a130b1be14d3801ee7fac6d90ff6fa3fafa
SSDEEP

192:Gren8VwgJxIGAVLwlLuuH8Ygzv8J023G83hPEQd0lLXalc0DI:aIGAVguo8bL8a23G83Nd0lDaZ0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
3728	msedge.exe
3728	msedge.exe
4872	identity_helper.exe
4872	identity_helper.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 2640	3728	msedge.exe	82
PID 3728 wrote to memory of 2640	3728	msedge.exe	82
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 3528	3728	msedge.exe	83
PID 3728 wrote to memory of 2164	3728	msedge.exe	84
PID 3728 wrote to memory of 2164	3728	msedge.exe	84
PID 3728 wrote to memory of 1732	3728	msedge.exe	85
PID 3728 wrote to memory of 1732	3728	msedge.exe	85
PID 3728 wrote to memory of 1732	3728	msedge.exe	85
PID 3728 wrote to memory of 1732	3728	msedge.exe	85
PID 3728 wrote to memory of 1732	3728	msedge.exe	85
PID 3728 wrote to memory of 1732	3728	msedge.exe	85
PID 3728 wrote to memory of 1732	3728	msedge.exe	85
PID 3728 wrote to memory of 1732	3728	msedge.exe	85
PID 3728 wrote to memory of 1732	3728	msedge.exe	85
PID 3728 wrote to memory of 1732	3728	msedge.exe	85
PID 3728 wrote to memory of 1732	3728	msedge.exe	85
PID 3728 wrote to memory of 1732	3728	msedge.exe	85
PID 3728 wrote to memory of 1732	3728	msedge.exe	85
PID 3728 wrote to memory of 1732	3728	msedge.exe	85
PID 3728 wrote to memory of 1732	3728	msedge.exe	85
PID 3728 wrote to memory of 1732	3728	msedge.exe	85
PID 3728 wrote to memory of 1732	3728	msedge.exe	85
PID 3728 wrote to memory of 1732	3728	msedge.exe	85
PID 3728 wrote to memory of 1732	3728	msedge.exe	85
PID 3728 wrote to memory of 1732	3728	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\786cc6f7a7d19cc1578f96d4d2522922_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdad846f8,0x7ffcdad84708,0x7ffcdad84718
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4364957890158132329,15142254770299282538,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,4364957890158132329,15142254770299282538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,4364957890158132329,15142254770299282538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4364957890158132329,15142254770299282538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4364957890158132329,15142254770299282538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4364957890158132329,15142254770299282538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4364957890158132329,15142254770299282538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4364957890158132329,15142254770299282538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4364957890158132329,15142254770299282538,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4364957890158132329,15142254770299282538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4364957890158132329,15142254770299282538,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4364957890158132329,15142254770299282538,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
182B

MD5
21288b4d9c0c0113b527ea64b5388e34

SHA1
634686f9842986ab0a3419eda6aa8f70f9c388cc

SHA256
4c7d2bb7f631e4d60278030e90bba17d19e024ba27d9b3e980587f3525561788

SHA512
45cb5e6cac3cff3a39b3e7f14c3b7eca0003c69218d69a8426e7cb843ac87dcfcf5e8e2149da337265a8ad2aa9d899956686a7dc569875dfe33efbbc3ee50d71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e48687f39af3328208fb9a19e2951da3

SHA1
35585cf58b6ff6d5821532fa67542a16074639bd

SHA256
1aa505a4d683149fd58d14455d3772cc1af53229c065b4a9b224097aa58207b3

SHA512
9b7296788c1d0636f46df639514ba32236ab0d845aef529c6b211810ac943606ccf586ee7dae1479414cb71b970a888ebda9b789e0a104560938b7ce6dd7deb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2e6a08ed702f51d0e9c2d72e6ff2c99c

SHA1
bd92d834c7cf498c058431a89b778f0888dcdc8b

SHA256
cb9f0582a09b4660729076d1760856cbfc33e4fafe4756bc98c30401bb94e303

SHA512
f8c6019a713bb9f8ddf8d7132b031a782c8098ba7889bf0247282e625d6942ab760760841b41dde7663dc84f594e73d2ed2ac36253afcf3f96418793e6e4ac68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
13da5603fcd062f8331a485b32dbee3f

SHA1
9176b27ebc1efa071b4c2e505066a7300e02a47c

SHA256
dd50b99f3698412119f1a1a239612f87ca0b942df0d14c4b7779b6ba9a343a46

SHA512
d085a7fd9543529b414eb2fa434174e21d279b4a5163f85a8eb3e303ad140f69570a4fa8264f9a928beb9eb909ed5672d6243241a6a79dca4bee190c22d76363

Download Submit