b6f99954cb69b80d48cbc02133beb21cc94f5a4270906b623678704e61ba68f8

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2861c62d219beaca2bf41cc26a7383d_JaffaCakes118.html
Size

461KB
MD5

a2861c62d219beaca2bf41cc26a7383d
SHA1

59a7691b964e0af9b11520cbdd6e2bf001f006e6
SHA256

b6f99954cb69b80d48cbc02133beb21cc94f5a4270906b623678704e61ba68f8
SHA512

848580c4732c01cf1fb8fcd45f77e0171e5b79c74cb2d868692676b64cf4381c9f1ba8780180d501faf27d27775d6b12537795c128c2526f17a8801976c38503
SSDEEP

6144:SvsMYod+X3oI+YVsMYod+X3oI+YIsMYod+X3oI+YLsMYod+X3oI+YQ:W5d+X3D5d+X3g5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
5016	msedge.exe
5016	msedge.exe
980	identity_helper.exe
980	identity_helper.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 1244	5016	msedge.exe	80
PID 5016 wrote to memory of 1244	5016	msedge.exe	80
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4112	5016	msedge.exe	81
PID 5016 wrote to memory of 4840	5016	msedge.exe	82
PID 5016 wrote to memory of 4840	5016	msedge.exe	82
PID 5016 wrote to memory of 1292	5016	msedge.exe	83
PID 5016 wrote to memory of 1292	5016	msedge.exe	83
PID 5016 wrote to memory of 1292	5016	msedge.exe	83
PID 5016 wrote to memory of 1292	5016	msedge.exe	83
PID 5016 wrote to memory of 1292	5016	msedge.exe	83
PID 5016 wrote to memory of 1292	5016	msedge.exe	83
PID 5016 wrote to memory of 1292	5016	msedge.exe	83
PID 5016 wrote to memory of 1292	5016	msedge.exe	83
PID 5016 wrote to memory of 1292	5016	msedge.exe	83
PID 5016 wrote to memory of 1292	5016	msedge.exe	83
PID 5016 wrote to memory of 1292	5016	msedge.exe	83
PID 5016 wrote to memory of 1292	5016	msedge.exe	83
PID 5016 wrote to memory of 1292	5016	msedge.exe	83
PID 5016 wrote to memory of 1292	5016	msedge.exe	83
PID 5016 wrote to memory of 1292	5016	msedge.exe	83
PID 5016 wrote to memory of 1292	5016	msedge.exe	83
PID 5016 wrote to memory of 1292	5016	msedge.exe	83
PID 5016 wrote to memory of 1292	5016	msedge.exe	83
PID 5016 wrote to memory of 1292	5016	msedge.exe	83
PID 5016 wrote to memory of 1292	5016	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a2861c62d219beaca2bf41cc26a7383d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6f0146f8,0x7ffc6f014708,0x7ffc6f014718
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,5747979049204656848,16571658122939702013,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2384 /prefetch:2
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,5747979049204656848,16571658122939702013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,5747979049204656848,16571658122939702013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5747979049204656848,16571658122939702013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5747979049204656848,16571658122939702013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,5747979049204656848,16571658122939702013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,5747979049204656848,16571658122939702013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5747979049204656848,16571658122939702013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5747979049204656848,16571658122939702013,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5747979049204656848,16571658122939702013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5747979049204656848,16571658122939702013,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,5747979049204656848,16571658122939702013,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7da2b6a1a7e6d581f128a441536e8e60

SHA1
43002198fafd970d07de89d39aa90331d7e96dee

SHA256
8d255477615ba42a01fcb359a2704946e858c513be78221ff5b68c31c301060e

SHA512
dcc6cf7b606a766fbc9c91688c2fc4c7aa7ede71341488ebaa98e4a28e96ebd783d502dbb3a4c074f638b139726f42c51412df8a2e2b5182af91c303a904cba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d77ac50ecd9d7719401965628226d194

SHA1
07299f7cea9093693d97f612a7739c86794e81b2

SHA256
c701d35093a2eb36f46faf357f3cfac755ce725f98ccda7f2b538f6e8728a31e

SHA512
8f88abe4ccac1ba642aa29e89309d197f9bf23217166fc5b7cdf2898d8bdec915ffa24981ffdb7be52ab6245274bb5c27fe1c2925bffa839bea61b516ecfe766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
e0715ced48eb1ecfacec0fa64be94166

SHA1
cdc54af1177395fd1e170c14fe2b9e20f6d59644

SHA256
12e4949b6ff5047917b74004d8e09f7967cc83f575d6146256edf66a06e4b865

SHA512
01ba1da643a82c484d7890f177626203ce3788adad3287109fcf7b57d0dde7d34710aad7cd7057d60054192de8d838e3d3a6a3281e1c2d241c18ea48d38ba35d

Download Submit