8664ddad7ee86c9772d10020b9ca5f84765beb15bf6e6c9fb7752352a79f77e6

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a962340bfd06935880482ed69e0ace51_JaffaCakes118.html
Size

201KB
MD5

a962340bfd06935880482ed69e0ace51
SHA1

dba4bf7dca42255bb2391ac3469499fe2327654b
SHA256

8664ddad7ee86c9772d10020b9ca5f84765beb15bf6e6c9fb7752352a79f77e6
SHA512

9e4e5f268f3b0705d53486bafc0cc668a3d1c29ef877881260fe63e367e5a23a99f8d48c64b2e955b10cf1d70ed684acae8aeab511345f16c9065fe874ccfb18
SSDEEP

1536:ka25V8YM2Ea96sMVALqSbdbX4qO1lih1edtLqiDrr2AGvM:d2zbX/8p

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3588	msedge.exe
3588	msedge.exe
4968	msedge.exe
4968	msedge.exe
4460	identity_helper.exe
4460	identity_helper.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4780	4968	msedge.exe	84
PID 4968 wrote to memory of 4780	4968	msedge.exe	84
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 4196	4968	msedge.exe	85
PID 4968 wrote to memory of 3588	4968	msedge.exe	86
PID 4968 wrote to memory of 3588	4968	msedge.exe	86
PID 4968 wrote to memory of 1000	4968	msedge.exe	87
PID 4968 wrote to memory of 1000	4968	msedge.exe	87
PID 4968 wrote to memory of 1000	4968	msedge.exe	87
PID 4968 wrote to memory of 1000	4968	msedge.exe	87
PID 4968 wrote to memory of 1000	4968	msedge.exe	87
PID 4968 wrote to memory of 1000	4968	msedge.exe	87
PID 4968 wrote to memory of 1000	4968	msedge.exe	87
PID 4968 wrote to memory of 1000	4968	msedge.exe	87
PID 4968 wrote to memory of 1000	4968	msedge.exe	87
PID 4968 wrote to memory of 1000	4968	msedge.exe	87
PID 4968 wrote to memory of 1000	4968	msedge.exe	87
PID 4968 wrote to memory of 1000	4968	msedge.exe	87
PID 4968 wrote to memory of 1000	4968	msedge.exe	87
PID 4968 wrote to memory of 1000	4968	msedge.exe	87
PID 4968 wrote to memory of 1000	4968	msedge.exe	87
PID 4968 wrote to memory of 1000	4968	msedge.exe	87
PID 4968 wrote to memory of 1000	4968	msedge.exe	87
PID 4968 wrote to memory of 1000	4968	msedge.exe	87
PID 4968 wrote to memory of 1000	4968	msedge.exe	87
PID 4968 wrote to memory of 1000	4968	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a962340bfd06935880482ed69e0ace51_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa00d46f8,0x7ffaa00d4708,0x7ffaa00d4718
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,13558469957009583029,15562181883595876236,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,13558469957009583029,15562181883595876236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,13558469957009583029,15562181883595876236,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13558469957009583029,15562181883595876236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13558469957009583029,15562181883595876236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13558469957009583029,15562181883595876236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,13558469957009583029,15562181883595876236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,13558469957009583029,15562181883595876236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13558469957009583029,15562181883595876236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13558469957009583029,15562181883595876236,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13558469957009583029,15562181883595876236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13558469957009583029,15562181883595876236,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,13558469957009583029,15562181883595876236,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
255B

MD5
84b28e8ffed9fa0b8f6a91b5b31b308d

SHA1
efaf4dff37c34966c481eef0caf7dacee9e2a78c

SHA256
cf81f066b1ba1e869f5551bbc61c497d91035e2afcb750c3e63d5c7644b0b29c

SHA512
a838f81d13c5ecf02aedcdc60159f4b3f6e22e1f14c566ee3b2765e5645fe0eebabe24124ac018ea64986261c904e5bb50512708babe39bde76d7a5ab9280ea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3335af3adebf47955e206fca8ca76aca

SHA1
c5521882fd31fa7b447101bb1b75c9a7d8e24ac9

SHA256
e50aa17ffd697249473812f8f6520dead8cac4061157ca16c8e5951f2694b2bb

SHA512
6897f27590b72c9fed8149a4de70a3551f54c9cebfcde0b1249dea896d91277e24feaf22abf751f37a96c3c997cd7cd4c796fe814385def33c13dc5d463f0803

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
32dc3cd402332f710f304b926d206e32

SHA1
c85d9da26e91171470a45f6c48f6f25e8331b9d0

SHA256
b2fc2d29e218c63e22fffac8895ea1ef656fcbd1f1d0f71c7c57b9ab303f551e

SHA512
5ae75bbc4886d32f6066b46df32062b01bad2d51acbb5045329eecaac665be53bb81e453b26bd21e1af7fa69abacdf93d613f7d5c52a64a62130eb3c7bf0c99e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ed1dd471e1ee3eb90dcc2b81a77a445c

SHA1
840c872f7febd3a23d1f15545b0226b3bfce3291

SHA256
6cae3f67e4ce6020b0de614069342f3417d1129c1cad55c210c956766b0e2fdb

SHA512
d7d340979f89d82dbc4da7fb8cb5da187837f3f877caddf34fb5448ac13bd05036e42210f419f594fdb88fe65f87476df630f4dd62b62ea6e9cb8eea92e5d598

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
70cd28195d986eb587c1010029d9bf26

SHA1
372884609cddcb0b97ca88e44184f63d67e4e6e6

SHA256
ecb609e4703990776e357b3033fd84af285ad6a7a79c5a63b93ac0d76dfba63e

SHA512
cdab1cea7dabfbb8b96e1b4a2d878154c32e8b4c196ca488ad93d3bb0a91c3350238793cfa026347da81c68930d6ae93639a56da05ccc211cf5a974865f66fed

Download Submit