f68be73256d3afedd427c717cb9ba0408ebde2b029df328366a2380f0f692a7c

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a98aa54091efa746c21723b7f79d2a70_JaffaCakes118.html
Size

460KB
MD5

a98aa54091efa746c21723b7f79d2a70
SHA1

328582bbe2375f8f0b4754dd0052b6240086f42e
SHA256

f68be73256d3afedd427c717cb9ba0408ebde2b029df328366a2380f0f692a7c
SHA512

5384f676f0998d83b52f120d9040ac363f915b4409144336a1deab645b1774c528708eaff8fcc7765701fa700795bc15e5a0dcfe6ff459ea704eddc91a52057f
SSDEEP

6144:SSsMYod+X3oI+YXsMYod+X3oI+Y9sMYod+X3oI+YLsMYod+X3oI+YQ:b5d+X3d5d+X3n5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe
1416	msedge.exe
1416	msedge.exe
1776	identity_helper.exe
1776	identity_helper.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 540	1416	msedge.exe	83
PID 1416 wrote to memory of 540	1416	msedge.exe	83
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 3792	1416	msedge.exe	84
PID 1416 wrote to memory of 2132	1416	msedge.exe	85
PID 1416 wrote to memory of 2132	1416	msedge.exe	85
PID 1416 wrote to memory of 4560	1416	msedge.exe	86
PID 1416 wrote to memory of 4560	1416	msedge.exe	86
PID 1416 wrote to memory of 4560	1416	msedge.exe	86
PID 1416 wrote to memory of 4560	1416	msedge.exe	86
PID 1416 wrote to memory of 4560	1416	msedge.exe	86
PID 1416 wrote to memory of 4560	1416	msedge.exe	86
PID 1416 wrote to memory of 4560	1416	msedge.exe	86
PID 1416 wrote to memory of 4560	1416	msedge.exe	86
PID 1416 wrote to memory of 4560	1416	msedge.exe	86
PID 1416 wrote to memory of 4560	1416	msedge.exe	86
PID 1416 wrote to memory of 4560	1416	msedge.exe	86
PID 1416 wrote to memory of 4560	1416	msedge.exe	86
PID 1416 wrote to memory of 4560	1416	msedge.exe	86
PID 1416 wrote to memory of 4560	1416	msedge.exe	86
PID 1416 wrote to memory of 4560	1416	msedge.exe	86
PID 1416 wrote to memory of 4560	1416	msedge.exe	86
PID 1416 wrote to memory of 4560	1416	msedge.exe	86
PID 1416 wrote to memory of 4560	1416	msedge.exe	86
PID 1416 wrote to memory of 4560	1416	msedge.exe	86
PID 1416 wrote to memory of 4560	1416	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a98aa54091efa746c21723b7f79d2a70_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5c0e46f8,0x7ffa5c0e4708,0x7ffa5c0e4718
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,10364809694938930434,2326871425007258655,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,10364809694938930434,2326871425007258655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,10364809694938930434,2326871425007258655,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10364809694938930434,2326871425007258655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10364809694938930434,2326871425007258655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,10364809694938930434,2326871425007258655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,10364809694938930434,2326871425007258655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10364809694938930434,2326871425007258655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10364809694938930434,2326871425007258655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10364809694938930434,2326871425007258655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10364809694938930434,2326871425007258655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,10364809694938930434,2326871425007258655,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1493f8e3722fd4bbcba90072c8361bc2

SHA1
6a7c92cb07e234035d058b5734a778100fedfea1

SHA256
5e3f8528b97022037ea7aeb41577d863fe06fcac1bfabdc132b06b162b1786ee

SHA512
0323b610a782cc7771cd8b8c1eacf00a599b3c26f553c2f0bf98b5eba533ce67bd7be26150e0c4e6317e514c85d7ac43ed80435e03d2759a39180b11616a7550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0725e3744dd6dfd75ebcbb6bec30834f

SHA1
c02e2c52f4962b6e0d9a9b5f3e54180e263bd6c1

SHA256
469704e4603d2c19f39260623f18410583e4cb40807f224152cb2cfd2a4c5601

SHA512
68fcd0a26d21522150ed0619ea8334ed4996786d88d64d49b54f1c39b8e36c5e4be1b0e1c266499f88db86714439237f4fd2fe7c7bbbd2a8b9d17212d45c0481

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
691eba460d5ced176405612387717f24

SHA1
1fa8435f52f8bb28dbb04e9194aaa504380e4823

SHA256
33baf5bcfa993b3fd990c7aff84dc6d76cd97f593396c34ef34768bd4667b765

SHA512
f645950caa2db39ad76b6068b68157cd2b78c479154094a1b08c43754740f5e14ec5b2bc38fa0bfaf4edc94b9e84ec0186a2668d1eec37ffb4b0c8f9b1ad885e

Download Submit