dc9fb302015eee56d6b4579e5804d3c7c659ce391c9d84c1ace2ebb32d7e7093

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8845a5e130af14e569f0e554b8d90d6e_JaffaCakes118.html
Size

66KB
MD5

8845a5e130af14e569f0e554b8d90d6e
SHA1

b6e6fc7183a009c673c87ddcfe40803f053c6c6c
SHA256

dc9fb302015eee56d6b4579e5804d3c7c659ce391c9d84c1ace2ebb32d7e7093
SHA512

96b1c06d7c6f3306ac7c74693f79bacdc1b5437ee0e4043a22b7b31170be73de2bfafd0f65f8282fc5a8c83a943dbec351265bbfd451f455acaf13cf48c916f7
SSDEEP

768:Ji5gcM0St8tN99OIskU1dHm9AxVm9HwNoTyOqhCZkoTnMdtbBnfBgN8/oycc8QF5:JZ+ajG+E6qTIgec0tbrgaCcFNnzAC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
5092	msedge.exe
5092	msedge.exe
2628	identity_helper.exe
2628	identity_helper.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 4624	5092	msedge.exe	81
PID 5092 wrote to memory of 4624	5092	msedge.exe	81
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 4588	5092	msedge.exe	83
PID 5092 wrote to memory of 1744	5092	msedge.exe	84
PID 5092 wrote to memory of 1744	5092	msedge.exe	84
PID 5092 wrote to memory of 4240	5092	msedge.exe	85
PID 5092 wrote to memory of 4240	5092	msedge.exe	85
PID 5092 wrote to memory of 4240	5092	msedge.exe	85
PID 5092 wrote to memory of 4240	5092	msedge.exe	85
PID 5092 wrote to memory of 4240	5092	msedge.exe	85
PID 5092 wrote to memory of 4240	5092	msedge.exe	85
PID 5092 wrote to memory of 4240	5092	msedge.exe	85
PID 5092 wrote to memory of 4240	5092	msedge.exe	85
PID 5092 wrote to memory of 4240	5092	msedge.exe	85
PID 5092 wrote to memory of 4240	5092	msedge.exe	85
PID 5092 wrote to memory of 4240	5092	msedge.exe	85
PID 5092 wrote to memory of 4240	5092	msedge.exe	85
PID 5092 wrote to memory of 4240	5092	msedge.exe	85
PID 5092 wrote to memory of 4240	5092	msedge.exe	85
PID 5092 wrote to memory of 4240	5092	msedge.exe	85
PID 5092 wrote to memory of 4240	5092	msedge.exe	85
PID 5092 wrote to memory of 4240	5092	msedge.exe	85
PID 5092 wrote to memory of 4240	5092	msedge.exe	85
PID 5092 wrote to memory of 4240	5092	msedge.exe	85
PID 5092 wrote to memory of 4240	5092	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8845a5e130af14e569f0e554b8d90d6e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe875746f8,0x7ffe87574708,0x7ffe87574718
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,11035705977963183890,14608779956314526477,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,11035705977963183890,14608779956314526477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,11035705977963183890,14608779956314526477,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,11035705977963183890,14608779956314526477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,11035705977963183890,14608779956314526477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,11035705977963183890,14608779956314526477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,11035705977963183890,14608779956314526477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,11035705977963183890,14608779956314526477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,11035705977963183890,14608779956314526477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,11035705977963183890,14608779956314526477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,11035705977963183890,14608779956314526477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,11035705977963183890,14608779956314526477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,11035705977963183890,14608779956314526477,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
cc918c28b5dca6522d126855270e0655

SHA1
f6997a66528a4610f955793d67af20afe950259a

SHA256
d9b06d58a63422c9a8adf9e8cc05409265ea1a4f3d34a632947c1d0d400a515c

SHA512
adf068b7d131deb055b9a11165e440ab85d361cb5de86fa5c624d5f46625582893d39d2134629002f25b40877dd6a4dd4bf53d4e86db448e2eee785efa5f7d2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
409B

MD5
b36af15fbe6f319c29dc10a21f74b715

SHA1
b458b3234112a1116efd0f734097efbf20c9d645

SHA256
e4f9a2e02844f539d8060c94b81e0c406bff0bdfa7a0f54b3f8585e3718d1ac6

SHA512
cb4e14243e97605c8841c76e8298b2fa6d0664e354cea33ebd0529ae185981437f505a630797bcaa8cc0cf98a569592708268fd7c592aa973ecbecaa42ac7c31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
761062b8345fc2cb95debfaec3254122

SHA1
f6a0cbf087cadef6e9a535930283a2126a9ef1ca

SHA256
6ce45379d5b2c3e5c914261de35e8b0d87f5d35112494b5c0e4f72f1a6a28529

SHA512
b4e11e91e701867d7ae20e8958d9f8ca68a8cd9cce22f3ec986dbceab1f3b8e32d24d36399a5967fcc5d25bcb5f3ad3e889dc758dca615c690383cf6aaed2a42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
35eca1cf838ffd0ac4d511d6cf4acb98

SHA1
411e0ca573196f9e3076eb14ce579d33f4c87190

SHA256
3715d21644fec03ee5265721423764e6ec296a7f24e89329539a90a690850869

SHA512
a6c04b82ceb35ca46b9763ed64b0273dfe68d58bf0df3076a8246dfb39de0f6077d315e048cecf09fc10ba208852145428d73ddc09b17332ce8914bf9aef66ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cbc28440-b04b-49a0-a28e-62ed16e66a58.tmp

Filesize
10KB

MD5
205daa15977dd8a9616d91cc563cd523

SHA1
dfb411f6791fa1e66dfab1f66f67e83eceaf7d4a

SHA256
8e2324a2bf51242be1ef415e188d8d233b1d21df4b9dbd9ba5db57d859611d1b

SHA512
139f19f50707a55d4ed0c6c17a6ea9fece4ed5f071035d316551fa60e881d6cf28a8e9210b1e6f0e18b290f04ca613070690f9e450d852571df6c6e504562b97

Download Submit