8ffb8f9229d9c05f30b7c59649ec5c8fd3f90cf092338497e1f63b607ae56274

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a6669b834a2aa593325f0c2555168dbf_JaffaCakes118.html
Size

36KB
MD5

a6669b834a2aa593325f0c2555168dbf
SHA1

906a566b320b9be6f3ae8eb9fa1ec7a3eeb738e2
SHA256

8ffb8f9229d9c05f30b7c59649ec5c8fd3f90cf092338497e1f63b607ae56274
SHA512

f204e5c2331622ad80d1cd2ef6696ac82e21c326e956f3d910a0e682405617b0f48266f8d577a72ed16aa034f27aa69cd6278835cefb9d588429d03626db9f16
SSDEEP

768:zwx/MDTH4i88hAR/ZPX+E1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TtZO46lrl6lLRcF:Q/rbJxNVuu0Sx/c8mK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3436	msedge.exe
3436	msedge.exe
1044	msedge.exe
1044	msedge.exe
4876	identity_helper.exe
4876	identity_helper.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 3112	1044	msedge.exe	82
PID 1044 wrote to memory of 3112	1044	msedge.exe	82
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 1780	1044	msedge.exe	83
PID 1044 wrote to memory of 3436	1044	msedge.exe	84
PID 1044 wrote to memory of 3436	1044	msedge.exe	84
PID 1044 wrote to memory of 852	1044	msedge.exe	85
PID 1044 wrote to memory of 852	1044	msedge.exe	85
PID 1044 wrote to memory of 852	1044	msedge.exe	85
PID 1044 wrote to memory of 852	1044	msedge.exe	85
PID 1044 wrote to memory of 852	1044	msedge.exe	85
PID 1044 wrote to memory of 852	1044	msedge.exe	85
PID 1044 wrote to memory of 852	1044	msedge.exe	85
PID 1044 wrote to memory of 852	1044	msedge.exe	85
PID 1044 wrote to memory of 852	1044	msedge.exe	85
PID 1044 wrote to memory of 852	1044	msedge.exe	85
PID 1044 wrote to memory of 852	1044	msedge.exe	85
PID 1044 wrote to memory of 852	1044	msedge.exe	85
PID 1044 wrote to memory of 852	1044	msedge.exe	85
PID 1044 wrote to memory of 852	1044	msedge.exe	85
PID 1044 wrote to memory of 852	1044	msedge.exe	85
PID 1044 wrote to memory of 852	1044	msedge.exe	85
PID 1044 wrote to memory of 852	1044	msedge.exe	85
PID 1044 wrote to memory of 852	1044	msedge.exe	85
PID 1044 wrote to memory of 852	1044	msedge.exe	85
PID 1044 wrote to memory of 852	1044	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a6669b834a2aa593325f0c2555168dbf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff896dd46f8,0x7ff896dd4708,0x7ff896dd4718
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,8289528159838006036,12170978991993315906,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,8289528159838006036,12170978991993315906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,8289528159838006036,12170978991993315906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8289528159838006036,12170978991993315906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8289528159838006036,12170978991993315906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,8289528159838006036,12170978991993315906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,8289528159838006036,12170978991993315906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8289528159838006036,12170978991993315906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8289528159838006036,12170978991993315906,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8289528159838006036,12170978991993315906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8289528159838006036,12170978991993315906,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,8289528159838006036,12170978991993315906,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
614B

MD5
077b6bd685c83916ac9d19a3272ffd54

SHA1
4b2f44f9adb54cacca103fccb20ac90859b83a62

SHA256
2100db6b10068f68b374f48f9f4a25ebefa473bc744d58120b30ce16e97aa2de

SHA512
da9d35814b5fb8d90347cf90dea34c263f8ed5c52b230bd6950787a5168f6658fe940d837bab6acbb4fa2ea19626fbfac6fa1a12eb9fd9c2cf1d1bd6b79d633c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c935c83a8ab2b93e50b2b79facfdc26

SHA1
482ebad69926d607a7e330e1fe382ebc10fa1868

SHA256
ebd2bd29a60ff4d239b5648f2e18e37ec72b1b3fcfdb41f9484feac66e402bd2

SHA512
b793083e43269b8e7cdb8cd14436bde3b5c6f46ac49792a34216f8560e2eeb20b78cc607b51fc26dd31b8ff965129af5711f4bb62b2d5db7fc8364e07aaa2fbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a126ce6315c4b5155c913c0b03160dde

SHA1
747199f68583e4745095f8c1daf279a79075f07a

SHA256
b35bbe8ed7fe5d1ee1517f5f04f57eb3174fbbd337f799e07bccdc9c0970e916

SHA512
c8919d75c9e81a89920990c7b72b7d58b045a6156ff0462f58e93e18d96ebd06d2eec58f2f0671356d0e21a0dccbc33c5b1a7849dd6147db6e8c4d7229b17a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bc1df213c616fe9a373ea26aa9a8a587

SHA1
6dc32873840d6d35553fed82c61ada655bea7202

SHA256
1709c51199a4f772ee429f636325844c6ce18077e274cd74ef1cf7e85125991e

SHA512
7286c6e53912ebef6848547f4e0f3bf7e3e8801249b3528fe55ef2b43b45badf7ba89b90cd2646dcba75a3239706c1fd9ad29f3c3a008a1af3d918b33151b6a3

Download Submit