73fa2e550a30865072c00e483f261f5447bb906244ef24b74ba9f82b0b2ac60c

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a4e6185b12789b68f106dcdb12f4813_JaffaCakes118.html
Size

69KB
MD5

9a4e6185b12789b68f106dcdb12f4813
SHA1

3c01526c4f51cec07969391366f40fa7ed5962d3
SHA256

73fa2e550a30865072c00e483f261f5447bb906244ef24b74ba9f82b0b2ac60c
SHA512

7b510720f22ef31d940e52a9d6ae361df02b27303d8f367520177faa7ce30f9abaa6562b76996f04a396d5b6c32f4a2f0ced2826ae029e31561ef18d746ec440
SSDEEP

1536:rfut4SS5SNSjSNS17g7Y767k7bolozotoToPp0pmp0p6peDnMLK+GQBeeeNeqean:rfujEPL67Lf8gwHZ5oomyPFOuco0AXPJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3420	msedge.exe
3420	msedge.exe
388	msedge.exe
388	msedge.exe
1416	identity_helper.exe
1416	identity_helper.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 3996	388	msedge.exe	81
PID 388 wrote to memory of 3996	388	msedge.exe	81
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 1568	388	msedge.exe	82
PID 388 wrote to memory of 3420	388	msedge.exe	83
PID 388 wrote to memory of 3420	388	msedge.exe	83
PID 388 wrote to memory of 3868	388	msedge.exe	84
PID 388 wrote to memory of 3868	388	msedge.exe	84
PID 388 wrote to memory of 3868	388	msedge.exe	84
PID 388 wrote to memory of 3868	388	msedge.exe	84
PID 388 wrote to memory of 3868	388	msedge.exe	84
PID 388 wrote to memory of 3868	388	msedge.exe	84
PID 388 wrote to memory of 3868	388	msedge.exe	84
PID 388 wrote to memory of 3868	388	msedge.exe	84
PID 388 wrote to memory of 3868	388	msedge.exe	84
PID 388 wrote to memory of 3868	388	msedge.exe	84
PID 388 wrote to memory of 3868	388	msedge.exe	84
PID 388 wrote to memory of 3868	388	msedge.exe	84
PID 388 wrote to memory of 3868	388	msedge.exe	84
PID 388 wrote to memory of 3868	388	msedge.exe	84
PID 388 wrote to memory of 3868	388	msedge.exe	84
PID 388 wrote to memory of 3868	388	msedge.exe	84
PID 388 wrote to memory of 3868	388	msedge.exe	84
PID 388 wrote to memory of 3868	388	msedge.exe	84
PID 388 wrote to memory of 3868	388	msedge.exe	84
PID 388 wrote to memory of 3868	388	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9a4e6185b12789b68f106dcdb12f4813_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff99cdf46f8,0x7ff99cdf4708,0x7ff99cdf4718
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,14649808814129919816,12002135906018184413,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,14649808814129919816,12002135906018184413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,14649808814129919816,12002135906018184413,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14649808814129919816,12002135906018184413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14649808814129919816,12002135906018184413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,14649808814129919816,12002135906018184413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,14649808814129919816,12002135906018184413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14649808814129919816,12002135906018184413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14649808814129919816,12002135906018184413,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14649808814129919816,12002135906018184413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14649808814129919816,12002135906018184413,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,14649808814129919816,12002135906018184413,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5484 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1c37930a60cd61e9c55999a65856f8a1

SHA1
60f5687f5abda6cdc10d585bd41f5f7abaef44e5

SHA256
23ef717c0310014ded70230c431f86b233f7637cb11226bde96d332a6423c1f5

SHA512
6290357168c957db9bfd0032ac44ba52b0ef28d36a48e5db447c40d74a9f85c8d3de46c215c92e5b4073f9b2ae7897650c477d597db674398a4b684b4c3106ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
207dfb3e2dee7d278ebddf7a1123d780

SHA1
961f7836e9eac09e6dae4b14239bc78616c2660a

SHA256
cd9485b7a80f7a2faf06475f32732f6fdeb250c977d96f64b6375054b5045fb2

SHA512
ad271f18c23577adae6a4b485fd275098fa839054a72bd562e3a2bec0e50709f710b2d848db4422b5bf3722e22b7a652271c94d2febac1cd435eedaf3b431810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c5a2bc4c9f66fe95f3edb4472a8872e7

SHA1
24d3055314e3b6ad6eb250a86b2196111bdf4a47

SHA256
6a86375a87461c18e3613bfafe935e35f56b4715b6618ee3ee63e372d6a5a5a1

SHA512
9db46c3cd53105e5cb76c4f52e1b6485614334a676b0eae2bd523b8efef350f89f8968520c5cc16526e4a5f1f7c27cb9e6b043687f571ff8c3ae3decc2a6661f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
70e78eb30702d27bc0a131973878abb5

SHA1
c1297e3a7ff39c8a1df57d43a91c2452558bf8cd

SHA256
71042767daf6b9c9d2be86665d82d9a372565d392afe5c8b72aef567a8175517

SHA512
9c818f37564bae1a1cff4cc2e91e1c0a1130bd3d9494e4b472639eb33e78223efb590ad8e0eec3c5691ef313705e86c127115329dbfd43649713f2b7b5ce1e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7afde635dc992506e82d6da8e5f52720

SHA1
92346657f1dcd9186dd7a48bacd71e4e6143255c

SHA256
2f540da65e5517724e293e38ce70593c405f8da22502a8d314b9dc4d5846210a

SHA512
783a9b169ee5bec995dfc3594d8d334cbb0baf596471300872bf95263a58c034d114c8e06a7ac7bcb5982e8ded6afef3c3645543572724db09cd74b4f81fc2ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
234529ff57a4154812ef38711f71cdc5

SHA1
d536c9bc133cacdd6e9d929d17e21923171f75d8

SHA256
3472cfb6ae3ed6c85de336f0ebdb870cf1957ad917a8f1e605873e286a71816a

SHA512
ac1b6891cc017c10053943e2ad0a41999a3d60321bcba3b2ab79aec997212011e2510c3be119dbaa7018888ee27213bfdd65a3dec76a5aabc9848df4b4c63590

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
20f90928bbe3d664ec5fe317601a77f9

SHA1
cad309231da53fa16bcc1431dd6642cb491dbbed

SHA256
e29fa8c92b5b635d13c69fadc1647ec08f24efd9b7e63d90943caaa3a460e904

SHA512
c4c4bbb5a8e588a3a58333934f40e50e16e0311b79aa88cd5fda3e6420493917155d5660816543cf6c1241f8cc6a109170c2f9c988b61747b9482abf6d259299

Download Submit