5f38a24b564e9af8aaed18aec8703f0839a8dd66841987b5960f51330088ba2c

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f7e2c2af9ce8a4156941cbaa46facb5_JaffaCakes118.html
Size

58KB
MD5

9f7e2c2af9ce8a4156941cbaa46facb5
SHA1

1d6c84ad3a5363f21c104790b86f6268c5dffabc
SHA256

5f38a24b564e9af8aaed18aec8703f0839a8dd66841987b5960f51330088ba2c
SHA512

f18776bc2dffd8e01af9b413c3b5bfd646e213b1885c1578ea6be344bb7ff85c898f7abc1e1534f52efe13af24dd8a89e77bbba703857dd849bb63421468f31a
SSDEEP

384:t2Yop0hzq18JZMrV0rEJOkWFFghpcurj/eb//1e/Ms/6kK5VzXtW04JAhAEaa8nB:7Q1gqrVN/6/8/L/ycAqE9wHaCHb/AG

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6048	msedge.exe
6048	msedge.exe
792	msedge.exe
792	msedge.exe
1976	identity_helper.exe
1976	identity_helper.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 6056	792	msedge.exe	80
PID 792 wrote to memory of 6056	792	msedge.exe	80
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 456	792	msedge.exe	81
PID 792 wrote to memory of 6048	792	msedge.exe	82
PID 792 wrote to memory of 6048	792	msedge.exe	82
PID 792 wrote to memory of 2580	792	msedge.exe	83
PID 792 wrote to memory of 2580	792	msedge.exe	83
PID 792 wrote to memory of 2580	792	msedge.exe	83
PID 792 wrote to memory of 2580	792	msedge.exe	83
PID 792 wrote to memory of 2580	792	msedge.exe	83
PID 792 wrote to memory of 2580	792	msedge.exe	83
PID 792 wrote to memory of 2580	792	msedge.exe	83
PID 792 wrote to memory of 2580	792	msedge.exe	83
PID 792 wrote to memory of 2580	792	msedge.exe	83
PID 792 wrote to memory of 2580	792	msedge.exe	83
PID 792 wrote to memory of 2580	792	msedge.exe	83
PID 792 wrote to memory of 2580	792	msedge.exe	83
PID 792 wrote to memory of 2580	792	msedge.exe	83
PID 792 wrote to memory of 2580	792	msedge.exe	83
PID 792 wrote to memory of 2580	792	msedge.exe	83
PID 792 wrote to memory of 2580	792	msedge.exe	83
PID 792 wrote to memory of 2580	792	msedge.exe	83
PID 792 wrote to memory of 2580	792	msedge.exe	83
PID 792 wrote to memory of 2580	792	msedge.exe	83
PID 792 wrote to memory of 2580	792	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9f7e2c2af9ce8a4156941cbaa46facb5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1ec946f8,0x7ffa1ec94708,0x7ffa1ec94718
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11983737273300427366,3574483549618157263,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,11983737273300427366,3574483549618157263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,11983737273300427366,3574483549618157263,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11983737273300427366,3574483549618157263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11983737273300427366,3574483549618157263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11983737273300427366,3574483549618157263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,11983737273300427366,3574483549618157263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,11983737273300427366,3574483549618157263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11983737273300427366,3574483549618157263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11983737273300427366,3574483549618157263,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11983737273300427366,3574483549618157263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11983737273300427366,3574483549618157263,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11983737273300427366,3574483549618157263,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
809B

MD5
c2141eba1e5edd9a06791e6c3f264ebd

SHA1
d9900f9062bcaf957d6ae9ecce4dd8b3b242cd1a

SHA256
5cacb6659d4aa5f7528eb849d6dc5384b86da4dadd6bf80dc2c7bed0975fec27

SHA512
b560560595d2b4f2e2af6348491cda3560f515e8de9ffc403bdf6dc9ef9bde709c3a58385d8ac15ce6dca44c6e7f3726af495e7643db4a1ccc36be7ef5e6865a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8d071a06c9bae3e76d5492d37ba2e34c

SHA1
cd644338acef000b62153335ff82b63c212c5457

SHA256
c3339e2d8ed4f7438d13902ecf3ad7881d91eff21adc383f779a9fa6b0e0f844

SHA512
e328379ff78635706233e1b77862a6d758aa121c262162c89af7978ce053a59cdd39c29aacbbccb1de4fd62353a71a104db4770676e9b19943a107172becd00d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f689f3fbde80d31f46ac9fdf995da525

SHA1
19ee9f4e1fae470fb1c865502bc8faecb0c1c8df

SHA256
b7007c1f463a44d973c85e443e2be3c47d2ed7064287a6e6df29286789533902

SHA512
28dfecbcd488b9e50e721e90495c514fdfd32aeba94749a15d0cfde8a60fc8ef15065c1d4732bef135216ad03a45c4bcc1d1e1f8ac21e27bfeb2fe913dfe5d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cf030787e5417fbc11d1793fbdaf46d8

SHA1
2ba94ef2c957ff2c4242aeaf8b4ef30b8c8c7ac6

SHA256
6421f2dc02b858ea7952b3642d3e080d505a130bfdf2d42d4650f602020e2a5f

SHA512
c26a7e04137f995dd1144bfb6b5dad018e66e27f7772e4fdcccad1aedb5d02abd573f63d9362b8cc09405c0ceb510260336e5ba6aaba0f725b2b0c553d198f40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
868a1f14e22146c8e9a9987b0780b56f

SHA1
351ca117400ee6cff71d4c19f0f64b730b1cc519

SHA256
e36903f73bca2cd94c524a10d2ecba74b61d51e235d94405bd2144de64201575

SHA512
2753a705ae62e671007ec8daf577de13fdd6ca36a7b6bb994f1a7d89988ce07e9c909540af01e8b0f4b7095e607aca7ab400c2ee661e3a6775f2fe96a9f63a9a

Download Submit