319ea6b5ddd5f886ba7a15625364e454661de06013fe4044b7831d9a1586e7a8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b7e737d0676be6b0ba558321acb9021_JaffaCakes118.html
Size

1KB
MD5

8b7e737d0676be6b0ba558321acb9021
SHA1

15df6e8a505c1cd95f901080e8d9e98ed6a2842b
SHA256

319ea6b5ddd5f886ba7a15625364e454661de06013fe4044b7831d9a1586e7a8
SHA512

3bd18ee8fcc4f42fb68cc08d3e06c70bdc0adcf00b0f22f9aa9c859f2d34ccafff60133986afe5e8051920f645dbec908ed398ee027a3bbcdb3dcc00e11eb886

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
1216	msedge.exe
1216	msedge.exe
4424	identity_helper.exe
4424	identity_helper.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 748	1216	msedge.exe	83
PID 1216 wrote to memory of 748	1216	msedge.exe	83
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 3568	1216	msedge.exe	84
PID 1216 wrote to memory of 4648	1216	msedge.exe	85
PID 1216 wrote to memory of 4648	1216	msedge.exe	85
PID 1216 wrote to memory of 3224	1216	msedge.exe	86
PID 1216 wrote to memory of 3224	1216	msedge.exe	86
PID 1216 wrote to memory of 3224	1216	msedge.exe	86
PID 1216 wrote to memory of 3224	1216	msedge.exe	86
PID 1216 wrote to memory of 3224	1216	msedge.exe	86
PID 1216 wrote to memory of 3224	1216	msedge.exe	86
PID 1216 wrote to memory of 3224	1216	msedge.exe	86
PID 1216 wrote to memory of 3224	1216	msedge.exe	86
PID 1216 wrote to memory of 3224	1216	msedge.exe	86
PID 1216 wrote to memory of 3224	1216	msedge.exe	86
PID 1216 wrote to memory of 3224	1216	msedge.exe	86
PID 1216 wrote to memory of 3224	1216	msedge.exe	86
PID 1216 wrote to memory of 3224	1216	msedge.exe	86
PID 1216 wrote to memory of 3224	1216	msedge.exe	86
PID 1216 wrote to memory of 3224	1216	msedge.exe	86
PID 1216 wrote to memory of 3224	1216	msedge.exe	86
PID 1216 wrote to memory of 3224	1216	msedge.exe	86
PID 1216 wrote to memory of 3224	1216	msedge.exe	86
PID 1216 wrote to memory of 3224	1216	msedge.exe	86
PID 1216 wrote to memory of 3224	1216	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8b7e737d0676be6b0ba558321acb9021_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x10c,0x110,0x114,0x108,0xe0,0x7ffdf58f46f8,0x7ffdf58f4708,0x7ffdf58f4718
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
87eff9504d7f11795b77c619ddca53eb

SHA1
364558d68ed1e41597949f2ac8b3fc83defa3ebb

SHA256
f677ed6304f53e79a0b69e85d18290c045bea4e6f186fe7b8a82494df1109546

SHA512
476d17713d940c3bc6ca11fd9f81f789d33bb3ac815c198d591c40011704010a470a076d778814094a7ae14dec77253f069918202791e6455deccf26bc1a8343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
404B

MD5
69b8d6ec89a4671d6fbabb609ab96b4d

SHA1
437503239f85849c1e6518cfc0f37e15ad570f56

SHA256
e704653737e44a54400753fbc2b79ae9d7f0d531b4dc3edd429e9073b9cf3fcd

SHA512
f12e487afcb42da96157a7c3e0b7db13286312baeb854f02218e50a850ea6f48f178562687f96d98f4a0db5bfde6da495fd4d949777b1a5a9f4b9b8f99c544f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
87b6d34dd4c72d8bdfb3735752766aaf

SHA1
fd16d00fe210b435ec8d3bbd708aa50b82319078

SHA256
c6a0e93e25cd947cf86a6996aa30bee5a6017d6fdb896c0c479e0a87e845f0d9

SHA512
643bb3e2a72e5ebf88825d436af28fc25f6c4eac47084d5fdf0addd377ffa570958c1e458186554e8448abcb984e9897024894fd64c4d428f45ffe932f32d241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
903b77fc45cb80ac2272996a236b683c

SHA1
6a8e0bd229c3fe53d3aea30d3d9014c4ba04b864

SHA256
9380ca01a50aabb3d8d6d2f4138cd26734937b29372ca33078c1236604098947

SHA512
252b2110f9eae35a59459cdf5e416dd5fd33bdca253963ab62cbdf6dc7265d5f1129f088a538c644300cdf60574544af2f701a9cdf8cdf64225e4a78bac6019c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
74d43f6ab191a3a4431d306b919e485a

SHA1
9e08344b251ccf027141ec52bf6ba137ff45fcac

SHA256
b660ea99b124c66a1693c093368f11584514fb802a697c1f7e63a3f379095a3f

SHA512
b5ddee4c6f7456289403096cab9b189ab75a2405c5ee73ce331160ffc1a14ea4152b62a76e2ed7b2de67734421a39e27c78835fd07904838d33ac3861f892017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
38a250cee94e20b4c82a3a239d247825

SHA1
d5840ea9b3217067c01a03eb1ce4605fed6bf41b

SHA256
dfa985e2f758f4d6a68d7bc556bb3080a7c134b3402da5ffa246d224696cb4cd

SHA512
7746cf8a7c566bcac508b33b783f3cd11f7bd048ac825f46c41a4af9879fec984ce41c32966531257253069a22a3a588cd6196a8b1a0a1140425c43c2f497500

Download Submit