bc22c8be854d16c3cd2a8fb2c583e151bb28e1476a0adb29df955647ac5299a1

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 07:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a89b624fda6eec0b1a4db65765545224_JaffaCakes118.html
Size

20KB
MD5

a89b624fda6eec0b1a4db65765545224
SHA1

5356875c7276279d86fb69eb34b1cf5e24fff8ca
SHA256

bc22c8be854d16c3cd2a8fb2c583e151bb28e1476a0adb29df955647ac5299a1
SHA512

edf96f8908e8b8adaec8d485a742f1c620890f964ea568ebf2dbcdd930d27b5701990d5e456787964f64d74c1fed63307f6459e3bae6480df56cc6cea8d88237
SSDEEP

384:fzDS9c28AbitDcKYXzCnGo43Uur3++jhFhYLh:bDS2tDY2Go43Zr3VHhYLh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2024	msedge.exe
2024	msedge.exe
980	msedge.exe
980	msedge.exe
3912	identity_helper.exe
3912	identity_helper.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 2392	980	msedge.exe	82
PID 980 wrote to memory of 2392	980	msedge.exe	82
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 3240	980	msedge.exe	83
PID 980 wrote to memory of 2024	980	msedge.exe	84
PID 980 wrote to memory of 2024	980	msedge.exe	84
PID 980 wrote to memory of 1168	980	msedge.exe	85
PID 980 wrote to memory of 1168	980	msedge.exe	85
PID 980 wrote to memory of 1168	980	msedge.exe	85
PID 980 wrote to memory of 1168	980	msedge.exe	85
PID 980 wrote to memory of 1168	980	msedge.exe	85
PID 980 wrote to memory of 1168	980	msedge.exe	85
PID 980 wrote to memory of 1168	980	msedge.exe	85
PID 980 wrote to memory of 1168	980	msedge.exe	85
PID 980 wrote to memory of 1168	980	msedge.exe	85
PID 980 wrote to memory of 1168	980	msedge.exe	85
PID 980 wrote to memory of 1168	980	msedge.exe	85
PID 980 wrote to memory of 1168	980	msedge.exe	85
PID 980 wrote to memory of 1168	980	msedge.exe	85
PID 980 wrote to memory of 1168	980	msedge.exe	85
PID 980 wrote to memory of 1168	980	msedge.exe	85
PID 980 wrote to memory of 1168	980	msedge.exe	85
PID 980 wrote to memory of 1168	980	msedge.exe	85
PID 980 wrote to memory of 1168	980	msedge.exe	85
PID 980 wrote to memory of 1168	980	msedge.exe	85
PID 980 wrote to memory of 1168	980	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a89b624fda6eec0b1a4db65765545224_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbdf746f8,0x7fffbdf74708,0x7fffbdf74718
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6389607804848375969,279658229873912217,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,6389607804848375969,279658229873912217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,6389607804848375969,279658229873912217,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6389607804848375969,279658229873912217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6389607804848375969,279658229873912217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6389607804848375969,279658229873912217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6389607804848375969,279658229873912217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6389607804848375969,279658229873912217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6389607804848375969,279658229873912217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6389607804848375969,279658229873912217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6389607804848375969,279658229873912217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6389607804848375969,279658229873912217,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
184B

MD5
f0794ab58d4ca1b719f942280a39f3c2

SHA1
994cc0f59a8473992fa5d02a20689d0ada38d0eb

SHA256
0ae1ec54c86cb5ede0b77ce0a82609ac977f6002493ce7f6d29777a37cdcf01f

SHA512
fae5221007fcb49d1991f2a4b8b950c0ecea1e7827928e414085867906bd63810ed307f71799ac25b1d58d51b9bc678a8aa56420dcdecf19b6514eaf8b946fa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df9b582a85ac4b50d5e45d069451afa9

SHA1
35c1ca82a5dfd7d485c201668924b944dbd97d7d

SHA256
a674536241934965545790f7a60973cb1624dd14a7173e658a32ef09d664e75f

SHA512
0ee3d666b3a3012c84865c7e3db2c60663448e26fb5677bb591ef90d1253b2d0b4ea257ecf3a1235096f1efd6d2a33638a4b87385d4db117c882cd3e5f806a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a46cdb8cfb0c21b4df368fa8a4cb5e58

SHA1
163fea37b9abf956369353a8ba0a75dd310c385e

SHA256
f1ff08865920f2e8dae9774f2b4a0d0cfb5fd32188b0e044df5d72ce210dfe8c

SHA512
fe7905f788c6ecab837bc26777e9f85fc64f2c08356031d747caea81b9706f10feaa50d6e5bcf2773de8e5ac1e7df537b0782d4b877d025a42b1b46b912c291a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41986247c64c85040eaed6485378cad0

SHA1
a16ce64d6e03533f4c3ee26ffd711a56c73ae306

SHA256
3d6d4d33acbf60ac1c1a7e2cb5f05634f7897c2de28b6d715bc8a0b6b95d72b5

SHA512
81e475708c5d748ec3e76c5390af3d028194a66049c2a5738b13e8af2d18c70868aad58d3b248032acc7edbb9946bf7d5329b8e835aba1d6ee67a44212c6b7ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
744e41428389d11e4967b16c93f2ed14

SHA1
b3abf4cd4c4963b8363fa757e04ff909032432f5

SHA256
d15b9c8a4fca1696df271c8b41c5f8eff14a70c62ad7827af3ab36d7304cfc73

SHA512
9eed6cc02861951e0e74b2ff3b4752c38a1f989f6991dc7ede8491cb63916bb6864335994c0ef920180a1bab92f7930acd56293a3ee50eb5460a70a17d17edec

Download Submit