ad3582204e605b2ccec3286b569ed68aca29aa876c41b06a9fe1df68355349d6

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a92fc606974a67eb8d39294d0f357134_JaffaCakes118.html
Size

25KB
MD5

a92fc606974a67eb8d39294d0f357134
SHA1

28d0a4a282f676a6a313384ee48af060b271d5c5
SHA256

ad3582204e605b2ccec3286b569ed68aca29aa876c41b06a9fe1df68355349d6
SHA512

64c420d7a33e15c07f69e8c9fac90e20d5843a6c4e8360ad8bb4389262a85e57f146db91ea5c0e57aaef1194138c62c186e770f6e234a334a57118d61dca3e64
SSDEEP

768:SlnniLqBwFLaqhY11wGITj4BTsHlfpTyYPh2NOBz:XqsbhY11wGITj4FsHlZHANm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
4520	msedge.exe
4520	msedge.exe
2052	identity_helper.exe
2052	identity_helper.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 720	4520	msedge.exe	81
PID 4520 wrote to memory of 720	4520	msedge.exe	81
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 2024	4520	msedge.exe	82
PID 4520 wrote to memory of 3060	4520	msedge.exe	83
PID 4520 wrote to memory of 3060	4520	msedge.exe	83
PID 4520 wrote to memory of 4404	4520	msedge.exe	84
PID 4520 wrote to memory of 4404	4520	msedge.exe	84
PID 4520 wrote to memory of 4404	4520	msedge.exe	84
PID 4520 wrote to memory of 4404	4520	msedge.exe	84
PID 4520 wrote to memory of 4404	4520	msedge.exe	84
PID 4520 wrote to memory of 4404	4520	msedge.exe	84
PID 4520 wrote to memory of 4404	4520	msedge.exe	84
PID 4520 wrote to memory of 4404	4520	msedge.exe	84
PID 4520 wrote to memory of 4404	4520	msedge.exe	84
PID 4520 wrote to memory of 4404	4520	msedge.exe	84
PID 4520 wrote to memory of 4404	4520	msedge.exe	84
PID 4520 wrote to memory of 4404	4520	msedge.exe	84
PID 4520 wrote to memory of 4404	4520	msedge.exe	84
PID 4520 wrote to memory of 4404	4520	msedge.exe	84
PID 4520 wrote to memory of 4404	4520	msedge.exe	84
PID 4520 wrote to memory of 4404	4520	msedge.exe	84
PID 4520 wrote to memory of 4404	4520	msedge.exe	84
PID 4520 wrote to memory of 4404	4520	msedge.exe	84
PID 4520 wrote to memory of 4404	4520	msedge.exe	84
PID 4520 wrote to memory of 4404	4520	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a92fc606974a67eb8d39294d0f357134_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8072a46f8,0x7ff8072a4708,0x7ff8072a4718
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,11953922818346153225,426137036929635580,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,11953922818346153225,426137036929635580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,11953922818346153225,426137036929635580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11953922818346153225,426137036929635580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11953922818346153225,426137036929635580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,11953922818346153225,426137036929635580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,11953922818346153225,426137036929635580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11953922818346153225,426137036929635580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11953922818346153225,426137036929635580,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11953922818346153225,426137036929635580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11953922818346153225,426137036929635580,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,11953922818346153225,426137036929635580,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\09c8accb-72f8-40bd-ae0a-9504b2560c47.tmp

Filesize
11KB

MD5
6e7878869d23247b29ffa80d67254ac8

SHA1
debfda5156ba02f84355f0d4e587b5e05c78d3db

SHA256
145e464204cd89723c6111a06816acc182cb581e17efaa3bac1dcb8ada580094

SHA512
c15a1f06acd83fc38ee23f715ab95ed234a1ed54d6e2be3e3cb50726d31c116e0c89738e398bff6ecca1035588cfee47a4207787e5d47d9a873aef2eba4a273a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
33KB

MD5
4d638ce4dd9b9b12c52ae8318827515f

SHA1
e1c26c6becd9b44711fb85b64ae66df54aba1891

SHA256
78feb6ec409aa8ce11bbc8890f01f95c48363a872f87e7c518c872155530211c

SHA512
4bcde825eec97e1ec76a34bdf31930f5e2a938a2c265e88bbbbc1b80d9b45a43f010fdfa00c49b42d347d13b01e8e0bb9ea75faee624162890627c818fe7b545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
189B

MD5
443319881835b14fda88caab9945e84c

SHA1
adb420bd20774e8eabc4d3d53ecfccb20ae7cb54

SHA256
fd79d0831e92ccbffc20eed3a0d07b39a121b4f3be4f720d2981fdd2e7b5b8da

SHA512
39c2c7fd638c04ce244473831d3dc8175e8e9ecb9a0df38370300233202d7d7fa9166912b8d97b34efd7b90eab6da376191e1c5c9ce253e96c9686b886ab29fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1061b844ab34b9d43a7b3fe88c5afc43

SHA1
f13610adb4b132a987923c6b4021241db1515df9

SHA256
3e7e9f862ed92ff1d5a2ccaa1cb2264bb2b20cf84d3067de8d657cbf3b80e7d6

SHA512
69f63847aa246174fc182e62208d8bdb08ad1d26a8303aaf0f359b8e9600d488cc3c3e2c3ecb5754b663df05e1741d9ee50e8aa83f5df358145811c917d0a3db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9cea77faa67ec9e0421b37c2ef075eb7

SHA1
8a952098715adcef9121ce3274a3e5f31c9e0954

SHA256
5bb1435d7eecc7ae80028d53d16267a2d850df20ba6d19f799ee53b5207602dc

SHA512
10dd3882a9d85edc3724ff6cd0012ef9bfe573007380d676a435dc0500bbfb3d1a09db07c555a137d5afb8bb9415d7dde40d7ad211d59374cc15fff6908055cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit