611ec9998f9b194cf8da47228af1e907d5b3ade3e7558180874d4d210fad7605

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a80bc54c7e6a66794d5ab53c9e4da559_JaffaCakes118.html
Size

36KB
MD5

a80bc54c7e6a66794d5ab53c9e4da559
SHA1

5cfbdc87943f4db39d4393eea2a2c9e546f66d22
SHA256

611ec9998f9b194cf8da47228af1e907d5b3ade3e7558180874d4d210fad7605
SHA512

85ad1b6be1a77154849e998373641e55bd52aad3af74168d6bde90e03774e5cbb8b46b85fcf0587b7f5886bde71ac31cbc3828fbfc59bc55c062aa4d9117164c
SSDEEP

768:zwx/MDTHas88hARPaZPX5E1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TOiC6u3l56lLRb:Q/zbJxNV+ufSI/U8dK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2344	msedge.exe
2344	msedge.exe
3544	identity_helper.exe
3544	identity_helper.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 436	2344	msedge.exe	81
PID 2344 wrote to memory of 436	2344	msedge.exe	81
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 3944	2344	msedge.exe	82
PID 2344 wrote to memory of 2172	2344	msedge.exe	83
PID 2344 wrote to memory of 2172	2344	msedge.exe	83
PID 2344 wrote to memory of 4648	2344	msedge.exe	84
PID 2344 wrote to memory of 4648	2344	msedge.exe	84
PID 2344 wrote to memory of 4648	2344	msedge.exe	84
PID 2344 wrote to memory of 4648	2344	msedge.exe	84
PID 2344 wrote to memory of 4648	2344	msedge.exe	84
PID 2344 wrote to memory of 4648	2344	msedge.exe	84
PID 2344 wrote to memory of 4648	2344	msedge.exe	84
PID 2344 wrote to memory of 4648	2344	msedge.exe	84
PID 2344 wrote to memory of 4648	2344	msedge.exe	84
PID 2344 wrote to memory of 4648	2344	msedge.exe	84
PID 2344 wrote to memory of 4648	2344	msedge.exe	84
PID 2344 wrote to memory of 4648	2344	msedge.exe	84
PID 2344 wrote to memory of 4648	2344	msedge.exe	84
PID 2344 wrote to memory of 4648	2344	msedge.exe	84
PID 2344 wrote to memory of 4648	2344	msedge.exe	84
PID 2344 wrote to memory of 4648	2344	msedge.exe	84
PID 2344 wrote to memory of 4648	2344	msedge.exe	84
PID 2344 wrote to memory of 4648	2344	msedge.exe	84
PID 2344 wrote to memory of 4648	2344	msedge.exe	84
PID 2344 wrote to memory of 4648	2344	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a80bc54c7e6a66794d5ab53c9e4da559_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffb7be46f8,0x7fffb7be4708,0x7fffb7be4718
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7008868419489093438,795648942299918132,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,7008868419489093438,795648942299918132,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,7008868419489093438,795648942299918132,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7008868419489093438,795648942299918132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7008868419489093438,795648942299918132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,7008868419489093438,795648942299918132,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,7008868419489093438,795648942299918132,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7008868419489093438,795648942299918132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7008868419489093438,795648942299918132,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7008868419489093438,795648942299918132,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7008868419489093438,795648942299918132,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7008868419489093438,795648942299918132,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
477462b6ad8eaaf8d38f5e3a4daf17b0

SHA1
86174e670c44767c08a39cc2a53c09c318326201

SHA256
e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d

SHA512
a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b704c9ca0493bd4548ac9c69dc4a4f27

SHA1
a3e5e54e630dabe55ca18a798d9f5681e0620ba7

SHA256
2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411

SHA512
69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
614B

MD5
53e4b67f1dcdfad2d3e8c2ead056e121

SHA1
95fc2fa5d192e150b7ffaa28ad6d11e40376b1e5

SHA256
9f9416cde034cc1bcbf0f0c09c3ec632cd2a0e79c6ffb6cf8e951f778f50bc55

SHA512
7754c63ab2a19a7bb93de2d77a467d08070a42c265750b20ee010c5a805580cb0c4d606447dd05e3e6fbad00218e7c7f09f04f6354c7f8570a73bb48baa11c1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8fb69ff42f5cb8d09f19d06629a9ce63

SHA1
5642a8ed29694726987b9c3291752590cd740826

SHA256
5a4f0563c0b214220bf9875e54588e35c53b183f5ab8b8b6d48684a5ee5de54b

SHA512
71e57d962a4c2e46eb589ebf605e41669b62e1fc906e5d7bfcb9ee7fe88b420c4b1b771b3d23375cbbea76034fcc36dfecb4efe4a970d1d4ba8ada33ebb59503

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bfc6c53ed019ce69c383b6649b05fa2e

SHA1
f3428d81fbd2f16063995f213b22c79a856e8c27

SHA256
1cb242fa8a9c54df37f6718a4708c4242382ce6b4ff946a62084613b1f0283ac

SHA512
f854ecaf294a10bbca4b0435c4e52dcd25c273ae84208da67281cba8453753db70901cd39b868fe5ef557a184759bf7235006d4ad9c3d61b7e4447ecbbda289a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
390cbe79997664b894c684bb0864d265

SHA1
22a00e6d5418bd113dd6d064e750a93cded96070

SHA256
aa32e7f3ab6192c14c042b3db6831746501c617e34a75e2051ec025b695b7911

SHA512
22050aeed88fa989a64c67122438976bd28772afc02c326e10d72042a309ef48cef949912e6d10fae1b0822abf449b9873f4af4f0402298c4e061478a2165e14

Download Submit