15f9c86f93ac25350a4c0f8de6d90d8750cc80bd16e2a0f489fb44c1de0e6fee

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a8535c62ba9853dfc71727cbb3bb07de_JaffaCakes118.html
Size

23KB
MD5

a8535c62ba9853dfc71727cbb3bb07de
SHA1

22ff6dcb8f039fda1cc1e0fbb3ecd430256e14c0
SHA256

15f9c86f93ac25350a4c0f8de6d90d8750cc80bd16e2a0f489fb44c1de0e6fee
SHA512

5deae2e135147d888c6f8f00adcb3534ee190ca89ad09eb23acd94cc75594f853a4e32b3940ab93b93a9fc7d149b45b0badc9c86b0f59a05d54eb55cd84068e7
SSDEEP

192:uW4vVmrqT2UPb5nrNTCGz9AkZPG29BJ3nQjxn5Q/ZznQieF2Nn2bOnQOkEntf/OB:5Q/TQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe
3660	msedge.exe
3660	msedge.exe
4500	identity_helper.exe
4500	identity_helper.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 4372	3660	msedge.exe	81
PID 3660 wrote to memory of 4372	3660	msedge.exe	81
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 1516	3660	msedge.exe	82
PID 3660 wrote to memory of 2188	3660	msedge.exe	83
PID 3660 wrote to memory of 2188	3660	msedge.exe	83
PID 3660 wrote to memory of 3268	3660	msedge.exe	84
PID 3660 wrote to memory of 3268	3660	msedge.exe	84
PID 3660 wrote to memory of 3268	3660	msedge.exe	84
PID 3660 wrote to memory of 3268	3660	msedge.exe	84
PID 3660 wrote to memory of 3268	3660	msedge.exe	84
PID 3660 wrote to memory of 3268	3660	msedge.exe	84
PID 3660 wrote to memory of 3268	3660	msedge.exe	84
PID 3660 wrote to memory of 3268	3660	msedge.exe	84
PID 3660 wrote to memory of 3268	3660	msedge.exe	84
PID 3660 wrote to memory of 3268	3660	msedge.exe	84
PID 3660 wrote to memory of 3268	3660	msedge.exe	84
PID 3660 wrote to memory of 3268	3660	msedge.exe	84
PID 3660 wrote to memory of 3268	3660	msedge.exe	84
PID 3660 wrote to memory of 3268	3660	msedge.exe	84
PID 3660 wrote to memory of 3268	3660	msedge.exe	84
PID 3660 wrote to memory of 3268	3660	msedge.exe	84
PID 3660 wrote to memory of 3268	3660	msedge.exe	84
PID 3660 wrote to memory of 3268	3660	msedge.exe	84
PID 3660 wrote to memory of 3268	3660	msedge.exe	84
PID 3660 wrote to memory of 3268	3660	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a8535c62ba9853dfc71727cbb3bb07de_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe11646f8,0x7fffe1164708,0x7fffe1164718
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,14899366600175864780,1173081506482333858,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,14899366600175864780,1173081506482333858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,14899366600175864780,1173081506482333858,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,14899366600175864780,1173081506482333858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,14899366600175864780,1173081506482333858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,14899366600175864780,1173081506482333858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,14899366600175864780,1173081506482333858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,14899366600175864780,1173081506482333858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,14899366600175864780,1173081506482333858,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,14899366600175864780,1173081506482333858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,14899366600175864780,1173081506482333858,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,14899366600175864780,1173081506482333858,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4692 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5e88a338dd3b523f93ac8e03e8b0cb99

SHA1
f162c5865008613f5867246546f88b58f2bee8ec

SHA256
98de454cffcc40c1f23a2dfe795bd3a53b4f903dab0ba774135fec88dc991458

SHA512
d2a1cc1e2659ddeb76eefe58c60ed21a65839820fe64dc55786168f1d650aefef25ff284f537b2c93898aedb3342f95eb404e96fff30b3a60bc12ca0b5690a75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
821c61d627dce0be8f80cc8aeac111aa

SHA1
090e4126aab4a0e308b9180e64832067e30be920

SHA256
df1f0c7616f32446d03479b11933958857fa63df01f4d4cab3101b51b4e60438

SHA512
2f6989c8af7d7a2feb6142dab8bbbd6b473d176acb8057dfab717103741c59e78b104c5104d7c19f5d0e1d311f4addd1275c13a1d5a22bc58b5ae44fcb45ee46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
49c9e293e916be5f156b5cedd2770115

SHA1
3fe5c4f965f19da3c47457f6c712fe9450bcd8da

SHA256
d44dad6481a7f82a4100462afaffd5cc6dc73aa36c0782c1920183d0bb4ecabf

SHA512
40c4eacbd08213454f220d4ca2c2f877bb3dbf1b066bf65073d03aa5e493fbeae82bd93df44550b6642edee8b0e2ba18a72777936435e61799ce1b2a2238f987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fe9aa411aa353b922e2f006e2228adfc

SHA1
9b5fb10f10e4f8dd741ad9ab549353707e4f06dc

SHA256
a2789811ad86e51ec2c56afc0d7d1c4adf718c432c0e299f0523ef587f3c570a

SHA512
b7daa705f83453f70b58c93f55ce9babce9d1cfa62d9bf547a22301251de2e82ce1b804409629ca76be33926171876594139ad822f6b51e4ac36c496102e198c

Download Submit