bf383ad5a5db3da7842bb064d6ea78d597a6dfd2fefec06fd5e3b544fd16e64b

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2024 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

852c68a39a8d8f677b95e433f78024a4_JaffaCakes118.html
Size

120KB
MD5

852c68a39a8d8f677b95e433f78024a4
SHA1

11672ef149cb8de043e82cd4e52cde57496a9acc
SHA256

bf383ad5a5db3da7842bb064d6ea78d597a6dfd2fefec06fd5e3b544fd16e64b
SHA512

64c7be8e0c15b14506d0793f481808c8b3c40f8f6dfca4bf033dc4c81e6d2aaa494b9c81bb081e239bd9da3f26bc0f07133250643eb6809dc065138b5cffa4ae
SSDEEP

3072:SPBJww2ZfyfkMY+BES09JXAnyrZalI+YQ:SpTsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
396	msedge.exe
396	msedge.exe
3864	identity_helper.exe
3864	identity_helper.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 2856	3208	msedge.exe	83
PID 3208 wrote to memory of 2856	3208	msedge.exe	83
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 664	3208	msedge.exe	84
PID 3208 wrote to memory of 396	3208	msedge.exe	85
PID 3208 wrote to memory of 396	3208	msedge.exe	85
PID 3208 wrote to memory of 960	3208	msedge.exe	86
PID 3208 wrote to memory of 960	3208	msedge.exe	86
PID 3208 wrote to memory of 960	3208	msedge.exe	86
PID 3208 wrote to memory of 960	3208	msedge.exe	86
PID 3208 wrote to memory of 960	3208	msedge.exe	86
PID 3208 wrote to memory of 960	3208	msedge.exe	86
PID 3208 wrote to memory of 960	3208	msedge.exe	86
PID 3208 wrote to memory of 960	3208	msedge.exe	86
PID 3208 wrote to memory of 960	3208	msedge.exe	86
PID 3208 wrote to memory of 960	3208	msedge.exe	86
PID 3208 wrote to memory of 960	3208	msedge.exe	86
PID 3208 wrote to memory of 960	3208	msedge.exe	86
PID 3208 wrote to memory of 960	3208	msedge.exe	86
PID 3208 wrote to memory of 960	3208	msedge.exe	86
PID 3208 wrote to memory of 960	3208	msedge.exe	86
PID 3208 wrote to memory of 960	3208	msedge.exe	86
PID 3208 wrote to memory of 960	3208	msedge.exe	86
PID 3208 wrote to memory of 960	3208	msedge.exe	86
PID 3208 wrote to memory of 960	3208	msedge.exe	86
PID 3208 wrote to memory of 960	3208	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\852c68a39a8d8f677b95e433f78024a4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e77046f8,0x7ff8e7704708,0x7ff8e7704718
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,9703063317843687405,5018111286436480878,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,9703063317843687405,5018111286436480878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,9703063317843687405,5018111286436480878,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2268 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,9703063317843687405,5018111286436480878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2872 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,9703063317843687405,5018111286436480878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2880 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,9703063317843687405,5018111286436480878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,9703063317843687405,5018111286436480878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,9703063317843687405,5018111286436480878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,9703063317843687405,5018111286436480878,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,9703063317843687405,5018111286436480878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,9703063317843687405,5018111286436480878,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,9703063317843687405,5018111286436480878,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
178B

MD5
88a25d8924e8d777675efca2097df388

SHA1
83e21a091011ee38147139a953abd1d2bdde32a6

SHA256
3511f4fa20fb6f1e117598bf9495fa924b3699d56feb85cb3e348e277d62293d

SHA512
785ac1b9213fece59663f483271e8ebefdb385f7285f8a1f4a05909fcaeca4e26696d41c45e82bc67ea180d3125c475c9f8c660eca9670efed096cde079548b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8f4a61d64ebb5197a89bbac487ef86de

SHA1
942cd89d0f598d52668a158ea8083bd4491d9bdb

SHA256
c2e0002c7a8c77e1e864822e41c95aadd7b4afae3f21ef88f064747d84783fd4

SHA512
60b9a229cfe3c41f426e3711605152006bb745da2ae0f42e3e66383b74755a75f96031ff4a961bee388a21f80f124543ca42d396988c7c8945784ceef89ac2b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b2d272beec65855a9e6ca7578a14b171

SHA1
2f572263fad00424bda81ee3eed27712bfc4be6a

SHA256
c77d09c538d74932afd33db9ba98dd1c3bca6d418bb3c85298e73e534ba26c49

SHA512
bb13ee95af8798f0e4e1cc47639ca6c0d834da71c00132039787ea33ba73d70d8ec8f8792ab41f86238aeaf419919f50cc0bcc5b3141808f277f724a4f193d3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c9113e575eb45b8d3e3819bda807612

SHA1
e6e74da4fd690e415267f9d14d8cb4fa1689b0e6

SHA256
dc0eec3ead646a7deab0ab94c3cee0713af13b34c08bb5aa8945e486621f5944

SHA512
557da5a0e8443f9d0a05c42054f2bd5e6eb537a85240d1fb41a2afdd5b299a5b68bb516e5c9fe1b2555b65699ad92d109ae2c00fa9772553d46cf43068c0970f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6814365c0d4b222dae3d95e4e78490a4

SHA1
30bd2fd1950ff045d37ecc868f8b1a137340f320

SHA256
c4cfb35c65f107364c98198490722ba6cb38b2f1e6633e241b3c232b3974c178

SHA512
d51cb6d5f8323fa39c5e2eb3394299edde9aa9960a99e167b7b69b3f6f702cd33c3128b2351426e47bce3f387e13bb98d0c2a2d9ddb4015361ef6c54c8daef81

Download Submit