d75d2f6fcb89ec0567b67bc39d0073f663a4c0903429e1fea7cf52d1c191e732

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a067641f63af70894eec35d07d3c5d11_JaffaCakes118.html
Size

462KB
MD5

a067641f63af70894eec35d07d3c5d11
SHA1

65b8f1a372937569e73c89ee165c9aee4967f47d
SHA256

d75d2f6fcb89ec0567b67bc39d0073f663a4c0903429e1fea7cf52d1c191e732
SHA512

5afa66097f7fc7b5df1274df392fce51bae3ec7567ca2ad44538b04b7c8a793bbbcb7150b634f13d86b15c0558cf61643f65fb2f36a032895fcb74f56bf49c0e
SSDEEP

12288:MwFurZX0EVaJG39rYNzqup00jsbfAO1c/+d:bsP3EpoH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
4800	msedge.exe
4800	msedge.exe
3180	identity_helper.exe
3180	identity_helper.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4732	4800	msedge.exe	80
PID 4800 wrote to memory of 4732	4800	msedge.exe	80
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 3176	4800	msedge.exe	82
PID 4800 wrote to memory of 2880	4800	msedge.exe	83
PID 4800 wrote to memory of 2880	4800	msedge.exe	83
PID 4800 wrote to memory of 1256	4800	msedge.exe	84
PID 4800 wrote to memory of 1256	4800	msedge.exe	84
PID 4800 wrote to memory of 1256	4800	msedge.exe	84
PID 4800 wrote to memory of 1256	4800	msedge.exe	84
PID 4800 wrote to memory of 1256	4800	msedge.exe	84
PID 4800 wrote to memory of 1256	4800	msedge.exe	84
PID 4800 wrote to memory of 1256	4800	msedge.exe	84
PID 4800 wrote to memory of 1256	4800	msedge.exe	84
PID 4800 wrote to memory of 1256	4800	msedge.exe	84
PID 4800 wrote to memory of 1256	4800	msedge.exe	84
PID 4800 wrote to memory of 1256	4800	msedge.exe	84
PID 4800 wrote to memory of 1256	4800	msedge.exe	84
PID 4800 wrote to memory of 1256	4800	msedge.exe	84
PID 4800 wrote to memory of 1256	4800	msedge.exe	84
PID 4800 wrote to memory of 1256	4800	msedge.exe	84
PID 4800 wrote to memory of 1256	4800	msedge.exe	84
PID 4800 wrote to memory of 1256	4800	msedge.exe	84
PID 4800 wrote to memory of 1256	4800	msedge.exe	84
PID 4800 wrote to memory of 1256	4800	msedge.exe	84
PID 4800 wrote to memory of 1256	4800	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a067641f63af70894eec35d07d3c5d11_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccea246f8,0x7ffccea24708,0x7ffccea24718
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,15450443489789147610,8688986740830037311,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,15450443489789147610,8688986740830037311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,15450443489789147610,8688986740830037311,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,15450443489789147610,8688986740830037311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,15450443489789147610,8688986740830037311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,15450443489789147610,8688986740830037311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,15450443489789147610,8688986740830037311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,15450443489789147610,8688986740830037311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,15450443489789147610,8688986740830037311,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,15450443489789147610,8688986740830037311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,15450443489789147610,8688986740830037311,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,15450443489789147610,8688986740830037311,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5440 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
326B

MD5
1aac375b60827b9859d42965b9701704

SHA1
9147ba7c2472942aadc3808fa6e108fd02db0161

SHA256
4458d711bd3329b93eef1f32fd1d8dc86b204d0dc4d25e298c84a9d4029f4645

SHA512
f1252f9318554833230d72fea3a846693f025c5c75b4bca736f092c0106348c86f37c6bca3085fc8dcb4eaf74baeda59952e415f255820d70a8764030b2795d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8cd83848a5da848ffea382777ae97553

SHA1
3d6c11f73cffb403efff02e2119ff377c22afcd8

SHA256
2aadb7267709c4250ea589daf32f25228b5f2f7fabd4a4e0338ed8637fdfd337

SHA512
222a9ac0e5b3a7dedd4c70f4d98d8a26ec63a1d84375c8515caa148c54e0a7c3004cd78e7ce9ae21800228432eace94f1b8d2eb99db1d71e48b79ff56eeafa21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b5857239956d483e3c966dfc98a2be50

SHA1
3b4759792e0894843cd984b72289ef4bf934fb79

SHA256
e52b1bbb3980f481bbc2bc71c2bf7b9ab7ce5f4186ff280007de96a0f77d6bb7

SHA512
9060f20f3565a83b87561f4b49c85140a24e868a176b26ffac7958fe109b1b4489fedc54286ba5502a1f9584e1d0c5ef794ab70ec936c642be5fd2e0ba65d5c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eef5ff5453b31ee28cf3eb70ca8564f4

SHA1
f88b48f12523ba460a79b499fa0956707d18eba6

SHA256
99d804da6b1fe75e755c234e4a01f865bbcecf9cb48f9c4f53adcb7cb26472ea

SHA512
569bdc7ae1dce47f8948d08d83eb56924c971e37887c88a0462c308b0d155a69dc8e7459897222cbd43493886049218b93211a7e1cb7a1ba6a525ab9535aa57d

Download Submit