9bb567bdcb7f5bbb9aef505576ca3fb05f5f8da00633a41f48fb18260212a2d2

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eeff5070e6c0ba2db1ffd4eb976c001_JaffaCakes118.html
Size

20KB
MD5

8eeff5070e6c0ba2db1ffd4eb976c001
SHA1

f18937cc9f252041ac1a35509a9878c16b010298
SHA256

9bb567bdcb7f5bbb9aef505576ca3fb05f5f8da00633a41f48fb18260212a2d2
SHA512

bb78f28ffe22ea654ff5b4d97e8895d9d1d501b326e996887ef0bae4d6a7aaa1dfb214dafc0973964f39bcb6c73fb0c01cc968cb5cbf0a31d5ccf4440547e977
SSDEEP

384:CanlVBbjPqoV+zji0Ft0LOzTQTzT+TCTGmvTG8LYqnJTydoBtUjw:nlVBbjik+zxPKPg0GmrGEJTydonUM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4696	msedge.exe
4696	msedge.exe
1360	msedge.exe
1360	msedge.exe
5084	identity_helper.exe
5084	identity_helper.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 4264	1360	msedge.exe	82
PID 1360 wrote to memory of 4264	1360	msedge.exe	82
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 2592	1360	msedge.exe	83
PID 1360 wrote to memory of 4696	1360	msedge.exe	84
PID 1360 wrote to memory of 4696	1360	msedge.exe	84
PID 1360 wrote to memory of 4020	1360	msedge.exe	85
PID 1360 wrote to memory of 4020	1360	msedge.exe	85
PID 1360 wrote to memory of 4020	1360	msedge.exe	85
PID 1360 wrote to memory of 4020	1360	msedge.exe	85
PID 1360 wrote to memory of 4020	1360	msedge.exe	85
PID 1360 wrote to memory of 4020	1360	msedge.exe	85
PID 1360 wrote to memory of 4020	1360	msedge.exe	85
PID 1360 wrote to memory of 4020	1360	msedge.exe	85
PID 1360 wrote to memory of 4020	1360	msedge.exe	85
PID 1360 wrote to memory of 4020	1360	msedge.exe	85
PID 1360 wrote to memory of 4020	1360	msedge.exe	85
PID 1360 wrote to memory of 4020	1360	msedge.exe	85
PID 1360 wrote to memory of 4020	1360	msedge.exe	85
PID 1360 wrote to memory of 4020	1360	msedge.exe	85
PID 1360 wrote to memory of 4020	1360	msedge.exe	85
PID 1360 wrote to memory of 4020	1360	msedge.exe	85
PID 1360 wrote to memory of 4020	1360	msedge.exe	85
PID 1360 wrote to memory of 4020	1360	msedge.exe	85
PID 1360 wrote to memory of 4020	1360	msedge.exe	85
PID 1360 wrote to memory of 4020	1360	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8eeff5070e6c0ba2db1ffd4eb976c001_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85d2746f8,0x7ff85d274708,0x7ff85d274718
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,550831459738115419,14262238183151270555,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,550831459738115419,14262238183151270555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,550831459738115419,14262238183151270555,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,550831459738115419,14262238183151270555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,550831459738115419,14262238183151270555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,550831459738115419,14262238183151270555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,550831459738115419,14262238183151270555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,550831459738115419,14262238183151270555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,550831459738115419,14262238183151270555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,550831459738115419,14262238183151270555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,550831459738115419,14262238183151270555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,550831459738115419,14262238183151270555,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5512 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
1237012826a4271d706ff2c80484bbb5

SHA1
cc3b3680cc295649ec9569fe63ba628575fd81bf

SHA256
786cdf44b4241062772309c1c36d779a5d3087b01ca72b615e2cb817b3c04741

SHA512
2a4367e7c102b4dd3e8186d562e8465b642db51a9fa3540217965544d97a2bb1206185e810671206a700f0f34465385456e07789755033fe4f74fc037a9cfbc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
21b43b4c5ae89ea47be5de3252022219

SHA1
1c3a44acf7e59a6cf62553d919bd45aa39297ebb

SHA256
07b3c07ff3b520f631b5356e7b1403b760d32394126dfbd6af2748eefcecdc9d

SHA512
b97692858d30ae964f50b5a363dcc1a9a5ce802d4ce3f53df82238117e75f341a77150ee8ffacffe72d717fefce6387b5d674a151307d8cb32330fc922506619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6796e82d29c7b32aed64591ef91f50a8

SHA1
9ae53ea88fca5130390f2be14f3561df96e6a98a

SHA256
70b11328551926895f5d206e2690a974dd2b7a4ca9a55285eea763d14d0c6c65

SHA512
cc86c6d317e44145b675eda6596397c69daecebf3d4149fd3d209fa166305d55b93ef899322f761a275565a94ca9f9f53057dd706a0359d0cc4c63755ce2b010

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a6907e9187eb2c5efe121c4150bbbea3

SHA1
2f01e819ace0dc4ed43d9039e0952897c4e3e05d

SHA256
96d5b48b027f49f866baa9e5b4c9d7e85ba3aedbc18a9d7de5f37a246cf9b0d8

SHA512
71ecb28a89dab4efca24d09404113dd6b2b292417ba5b46cfa6ec96b9195c421122d7e5eb54c3f9a3971e97f67d75f39f8978be5f8eb0173caf3b10758ed3ec3

Download Submit