6b8188bf3d4583548599e945cf9618852ff52ba56c410f5d2c0bcb960f5be2cd

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 11:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a97c63cc1119c78dc1c54e825b3c351e_JaffaCakes118.html
Size

460KB
MD5

a97c63cc1119c78dc1c54e825b3c351e
SHA1

e8cd5f578af4935c124e504fb6487d3a62233167
SHA256

6b8188bf3d4583548599e945cf9618852ff52ba56c410f5d2c0bcb960f5be2cd
SHA512

2d4f2b6db63af562ebb12ecfc32bb96646309f79054717426f31f5a9b9c61b5fa430e66efb1c70bc3958887253b7cd267321339345122e0b7982be2b19c880fb
SSDEEP

6144:SBsMYod+X3oI+YLsMYod+X3oI+YpZsMYod+X3oI+YLsMYod+X3oI+YQ:e5d+X3l5d+X3d5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
2824	msedge.exe
2824	msedge.exe
4324	identity_helper.exe
4324	identity_helper.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 4192	2824	msedge.exe	85
PID 2824 wrote to memory of 4192	2824	msedge.exe	85
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 2912	2824	msedge.exe	87
PID 2824 wrote to memory of 4032	2824	msedge.exe	88
PID 2824 wrote to memory of 4032	2824	msedge.exe	88
PID 2824 wrote to memory of 2320	2824	msedge.exe	89
PID 2824 wrote to memory of 2320	2824	msedge.exe	89
PID 2824 wrote to memory of 2320	2824	msedge.exe	89
PID 2824 wrote to memory of 2320	2824	msedge.exe	89
PID 2824 wrote to memory of 2320	2824	msedge.exe	89
PID 2824 wrote to memory of 2320	2824	msedge.exe	89
PID 2824 wrote to memory of 2320	2824	msedge.exe	89
PID 2824 wrote to memory of 2320	2824	msedge.exe	89
PID 2824 wrote to memory of 2320	2824	msedge.exe	89
PID 2824 wrote to memory of 2320	2824	msedge.exe	89
PID 2824 wrote to memory of 2320	2824	msedge.exe	89
PID 2824 wrote to memory of 2320	2824	msedge.exe	89
PID 2824 wrote to memory of 2320	2824	msedge.exe	89
PID 2824 wrote to memory of 2320	2824	msedge.exe	89
PID 2824 wrote to memory of 2320	2824	msedge.exe	89
PID 2824 wrote to memory of 2320	2824	msedge.exe	89
PID 2824 wrote to memory of 2320	2824	msedge.exe	89
PID 2824 wrote to memory of 2320	2824	msedge.exe	89
PID 2824 wrote to memory of 2320	2824	msedge.exe	89
PID 2824 wrote to memory of 2320	2824	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a97c63cc1119c78dc1c54e825b3c351e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe66c646f8,0x7ffe66c64708,0x7ffe66c64718
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15959137767792592540,13849722177965124564,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,15959137767792592540,13849722177965124564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,15959137767792592540,13849722177965124564,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15959137767792592540,13849722177965124564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15959137767792592540,13849722177965124564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15959137767792592540,13849722177965124564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15959137767792592540,13849722177965124564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15959137767792592540,13849722177965124564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15959137767792592540,13849722177965124564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15959137767792592540,13849722177965124564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15959137767792592540,13849722177965124564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15959137767792592540,13849722177965124564,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4636 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
257c0005d0c4d0bb282cb470925e4376

SHA1
f9b8efb511ed64292568977c9f2ec255509e8f7d

SHA256
8185c36aaacfc71e42f94fad8e198fe7fb2d868398ceabb89261cae94341cb22

SHA512
2f3e8f352ed3ef88e8c28650390f93f98c92174d268330b886f3ebd1ba0163999051298ee12a054606b4986005452a241c6864cd292e69492d79c37d500556f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4819fbc4513c82d92618f50a379ee232

SHA1
ab618827ff269655283bf771fc957c8798ab51ee

SHA256
05e479e8ec96b7505e01e5ec757ccfe35cb73cd46b27ff4746dce90d43d9237c

SHA512
bc24fb972d04b55505101300e268f91b11e5833f1a18e925b5ded7e758b5e3e08bee1aa8f3a0b65514d6df981d0cbfa8798344db7f2a3675307df8de12ae475b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8f42065bb575c061429fe48610ceb156

SHA1
f94edf951b91398208f19c73609a4385fd94bca0

SHA256
4f9da438eefcbf4deffc129a677f459b20d530b87d14f608a1c1b47fa7e0a27b

SHA512
06325854ce6ae368a5746e45f5fae1ac875e7e48e195ccce7036e08efa9c6baad3fb6dc3c1e8fea06e4b41788b80363205ce6107d54652cc72dcfe8ac6ad3e00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1851e58a0f585002f42aad5f4359a6c1

SHA1
262157a7c048bccd759813a2e08c9e08f3f12830

SHA256
30eb0930e975a49090d296c6b420a23db09b281ff0f197fc347e8b6940efc445

SHA512
faa1d6b7a65ba1bd1382c4bc3487505aae0f92758b6d05a97a927c687ed579ffa004553430b77f3959a76f555a57d0117ad42cb8e66c895811ff5c04791a1fd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
95cd1581c30a5c26f698a8210bcab430

SHA1
5e8e551a47dd682ec51a7d6808fe8e0f2af39e86

SHA256
d58162c5ae5e18fc06604c285e024c01686093d70994dc93b4ae9d85b4c3f7b9

SHA512
e49403df10177053634c431203a91d26df5dfb23cbbb88847459ecdf4b6107040d0944a3e84ee6bb26cb4e8017a35c8c31b658387cd1b6938ba4cb9f59606ece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
576ddf1702c22f52a2e166fe2160ff18

SHA1
ae9dcc8b7b5bb6ef4dfa4e605ae1df80e47f7bd2

SHA256
2077be41758a84c6845d510369ce6382e75b5295eb69f3bdd752da79cef9105e

SHA512
90f4159d819c482267a8c3edef25046b4192198bbad87ae470212ff81b4198a21b4ebe38bdd13052af3aa77346cffaeffb527c4212e38469135a85e424a38446

Download Submit