6052c93bde84630789ad29077365b55bd98754b4a59931f7bd88b7d5a79ee654

Analysis

max time kernel
141s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c5d1e906d0e121e5e1d2e068b700dcf_JaffaCakes118.html
Size

75KB
MD5

9c5d1e906d0e121e5e1d2e068b700dcf
SHA1

96c1e4c50aef42a933be4e1e4ce6b11674c851b8
SHA256

6052c93bde84630789ad29077365b55bd98754b4a59931f7bd88b7d5a79ee654
SHA512

7b7caf170b33b32d4cb0a8981fd9382ad7b17002819e9ee772b2f078dbbc7d574ff06ee765fd0d3d4507b372eee044fc970d2339756f14fdd801ff38e0c2134e
SSDEEP

1536:oqBy3nAdbFmyBvbX5NPddG9m7/OqJkYfq+yA5ssNF:oqBy3nSFmyBvbX5NS9m7Ksn

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
3216	msedge.exe
3216	msedge.exe
5064	identity_helper.exe
5064	identity_helper.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 1264	3216	msedge.exe	80
PID 3216 wrote to memory of 1264	3216	msedge.exe	80
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 3848	3216	msedge.exe	81
PID 3216 wrote to memory of 1228	3216	msedge.exe	82
PID 3216 wrote to memory of 1228	3216	msedge.exe	82
PID 3216 wrote to memory of 4400	3216	msedge.exe	83
PID 3216 wrote to memory of 4400	3216	msedge.exe	83
PID 3216 wrote to memory of 4400	3216	msedge.exe	83
PID 3216 wrote to memory of 4400	3216	msedge.exe	83
PID 3216 wrote to memory of 4400	3216	msedge.exe	83
PID 3216 wrote to memory of 4400	3216	msedge.exe	83
PID 3216 wrote to memory of 4400	3216	msedge.exe	83
PID 3216 wrote to memory of 4400	3216	msedge.exe	83
PID 3216 wrote to memory of 4400	3216	msedge.exe	83
PID 3216 wrote to memory of 4400	3216	msedge.exe	83
PID 3216 wrote to memory of 4400	3216	msedge.exe	83
PID 3216 wrote to memory of 4400	3216	msedge.exe	83
PID 3216 wrote to memory of 4400	3216	msedge.exe	83
PID 3216 wrote to memory of 4400	3216	msedge.exe	83
PID 3216 wrote to memory of 4400	3216	msedge.exe	83
PID 3216 wrote to memory of 4400	3216	msedge.exe	83
PID 3216 wrote to memory of 4400	3216	msedge.exe	83
PID 3216 wrote to memory of 4400	3216	msedge.exe	83
PID 3216 wrote to memory of 4400	3216	msedge.exe	83
PID 3216 wrote to memory of 4400	3216	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9c5d1e906d0e121e5e1d2e068b700dcf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb576846f8,0x7ffb57684708,0x7ffb57684718
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,8503049474297776097,4595948954635365516,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,8503049474297776097,4595948954635365516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,8503049474297776097,4595948954635365516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8503049474297776097,4595948954635365516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8503049474297776097,4595948954635365516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8503049474297776097,4595948954635365516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8503049474297776097,4595948954635365516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,8503049474297776097,4595948954635365516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,8503049474297776097,4595948954635365516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8503049474297776097,4595948954635365516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8503049474297776097,4595948954635365516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8503049474297776097,4595948954635365516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,8503049474297776097,4595948954635365516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,8503049474297776097,4595948954635365516,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
553B

MD5
1f8a4cb27364e7228ad7466677ed6d1a

SHA1
ce844314125528e899acff35ca7ef31abb95d770

SHA256
3b790a5851b10421e7084042721076aff64e27cd67b40d860c508f0436f0be4e

SHA512
c81a9b1324b5a0da10a66415578852b7991666033a3ca0766fadb6aa4d06bc8e4df5ee828ee94368f2027cecd2abc895bd77df6de001fff1f9b92fee70b70ca7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d94cd7bb827af03c827b3db5763af7c1

SHA1
6710acc64812fd2a86a491a6db6e3eb4ed8f601c

SHA256
9756ee9bea85cb11a0004de79db8e4550aa70fd24c16b4c5e9effaba4ef9cbf6

SHA512
90a048d4688d215387f110fafb302734ff3c097de984f6bd5bf53cd6d4c9c4fad4710b8e5f6f59f3fc19e4793996e7f876fd00668cfafc1441997c6703010429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c87220323dc65fa9338abfe26318e67

SHA1
30e6318335cf600f3f30f26ccefab1ab121ae949

SHA256
a91283a38e57a3494a6d12ef4728b400eb7166941022448f1966ec925ad83776

SHA512
2cbff7c7941450bda488cf00115a5541228527b825de6317de3460604c865e1de279f2cb3f95a50679fd2e85c00ee6137f656c1a11a895c138c7cbac973e83d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
73ae7932d267299ea3178c5093fb0cca

SHA1
2c009827649242246d5c938e5b182ff795df0f81

SHA256
78bd2660cbcfa3800091debed054f235e7fa7ff16e3b7705779d4ba76fc3245b

SHA512
b77da545de1c1f2da7c00910812d2f29cd9ed5209d8b51d3effcb4eecf7cdbf07e3a7d423a5a19ab500e8c3afe49b51aba4d7dc36b7cb2dd5479ac4e7969f090

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
36547d0dbdbb1fd66b52381b4cc858e5

SHA1
9d23612a8909425e09c8500fe316e09f79a0d1b8

SHA256
0a8acbc9c8886693b1e0b1b27e205ec40f4c8063d2c283201807d99591c07078

SHA512
d746a9ce5694d06864d4906f2f68e850e1fdd6c95feca0d64cd042086415b6e712404756f9baaae62474f598c72fa8517e49159ef1f9963a4955fc2dac2b9fd0

Download Submit