34def27f660050838835fa227a7064f70e7f7c8d1d6fef305b8f4496c050797a

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cf5ec2a338f8f2cfc0e89868b2e50ae_JaffaCakes118.html
Size

25KB
MD5

8cf5ec2a338f8f2cfc0e89868b2e50ae
SHA1

b99ced8b53d6921ead11e8a4f7d63d63fe286e4a
SHA256

34def27f660050838835fa227a7064f70e7f7c8d1d6fef305b8f4496c050797a
SHA512

e94cdadccaabd7b9730bb002ad1d0d797292202f3a0407743a95c2e313128af71d2fa1b5f4ceaff8358e8d85889768e3e193f18a3ebbc8402a9364e9d4193003
SSDEEP

192:uWzaOb5nWcanQjxn5Q/6nQie5NnjnQOkEntSUnQTbn1nQUYqCBAspdEA4cwqHXMI:4oQ/FddFOK9

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
380	msedge.exe
380	msedge.exe
5028	msedge.exe
5028	msedge.exe
3140	identity_helper.exe
3140	identity_helper.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 2388	5028	msedge.exe	82
PID 5028 wrote to memory of 2388	5028	msedge.exe	82
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 3524	5028	msedge.exe	83
PID 5028 wrote to memory of 380	5028	msedge.exe	84
PID 5028 wrote to memory of 380	5028	msedge.exe	84
PID 5028 wrote to memory of 3228	5028	msedge.exe	85
PID 5028 wrote to memory of 3228	5028	msedge.exe	85
PID 5028 wrote to memory of 3228	5028	msedge.exe	85
PID 5028 wrote to memory of 3228	5028	msedge.exe	85
PID 5028 wrote to memory of 3228	5028	msedge.exe	85
PID 5028 wrote to memory of 3228	5028	msedge.exe	85
PID 5028 wrote to memory of 3228	5028	msedge.exe	85
PID 5028 wrote to memory of 3228	5028	msedge.exe	85
PID 5028 wrote to memory of 3228	5028	msedge.exe	85
PID 5028 wrote to memory of 3228	5028	msedge.exe	85
PID 5028 wrote to memory of 3228	5028	msedge.exe	85
PID 5028 wrote to memory of 3228	5028	msedge.exe	85
PID 5028 wrote to memory of 3228	5028	msedge.exe	85
PID 5028 wrote to memory of 3228	5028	msedge.exe	85
PID 5028 wrote to memory of 3228	5028	msedge.exe	85
PID 5028 wrote to memory of 3228	5028	msedge.exe	85
PID 5028 wrote to memory of 3228	5028	msedge.exe	85
PID 5028 wrote to memory of 3228	5028	msedge.exe	85
PID 5028 wrote to memory of 3228	5028	msedge.exe	85
PID 5028 wrote to memory of 3228	5028	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8cf5ec2a338f8f2cfc0e89868b2e50ae_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef94246f8,0x7ffef9424708,0x7ffef9424718
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2263952605964506331,10750905363935811528,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,2263952605964506331,10750905363935811528,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,2263952605964506331,10750905363935811528,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2263952605964506331,10750905363935811528,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2263952605964506331,10750905363935811528,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2263952605964506331,10750905363935811528,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2263952605964506331,10750905363935811528,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2263952605964506331,10750905363935811528,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2263952605964506331,10750905363935811528,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2263952605964506331,10750905363935811528,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2263952605964506331,10750905363935811528,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1756 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2263952605964506331,10750905363935811528,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4184 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
39f537d9ee6a947ed55e3d0075a0deb6

SHA1
7d9fab66fbb3a4bb1aa992babd745191d1c8c9f2

SHA256
b455f615604524b2a044fe0d297f10eeb0f08143445549de3db0f2d7c0861378

SHA512
48bf9329726c6b6e6202ffe4e60aabd14969545d62d91764fd4797ccf95b12824e0591145dedab38216356c0773248e0807dd4392ac70b1f7f1af5f4f9b2de1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4fb4e29607cb2db46f3052ffaac7e1c5

SHA1
f21e66af21ce9f3fb602d7ec0b8bcfb167dc2625

SHA256
15643f311e718cf0ea3e2dcba57bfaafbde7ecc9f0469eb191989fd3e2275317

SHA512
81d06ff2d841286ce11d41497d16500adb77829e78aee07ecd8ea287d2986a68c4c4255c9296e3e69ff26c5525ca16530e697861e45a40c152c1c51cc7a0df33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
137356fc443851328780398136193cb9

SHA1
20ecc3c202108dfcef18dfd262a77a96b36c27f0

SHA256
de3e578b552f632b84114310d943c9eec5da0b02d92098c4a200d6c154143b04

SHA512
0efe0813f1f2683e1333b3606d4791bbd6c1a1195aabc99b0f1692a06fc3c681951d75e59856ae4a140d0360dc2b6feb3abd2136fc1a058ca287f79d42cc3ac2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5aa47f0c117d97dc2ac51b43b340b59d

SHA1
23731bef417a47b7d41e1e0b7728558643116f11

SHA256
82e930247a6baa1b4317ee341078c985e2b040a2395b28e344ae1a3eabc658df

SHA512
eb3736ba03fe74b369e370034f2edd4a74c7ada52846571c4a2946d93a1739082498ee5ceb16eaf68e0e4075ee911c119771594e2c11504f034a2767c21ae7e3

Download Submit