1c9f7b966762cd29045e364eb7203b3197adbd426a3a320ef947e242c113f2e4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa9df50b6ba77e6425b2d415348b824f_JaffaCakes118.html
Size

204B
MD5

aa9df50b6ba77e6425b2d415348b824f
SHA1

cf1bb7b905303c23a5049f3c1f2b25cc694ce118
SHA256

1c9f7b966762cd29045e364eb7203b3197adbd426a3a320ef947e242c113f2e4
SHA512

c6d9b61f4a75e9bd668fe1a3a7b13657fa6ae79d1fb0cb4251bfbc80f6408fb6cc6263c203da45e1dd09787037f20bd3477f1cc79ebd03ab05688e496093b8dc

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
3592	msedge.exe
3592	msedge.exe
404	identity_helper.exe
404	identity_helper.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 3572	3592	msedge.exe	81
PID 3592 wrote to memory of 3572	3592	msedge.exe	81
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 4396	3592	msedge.exe	82
PID 3592 wrote to memory of 5076	3592	msedge.exe	83
PID 3592 wrote to memory of 5076	3592	msedge.exe	83
PID 3592 wrote to memory of 856	3592	msedge.exe	84
PID 3592 wrote to memory of 856	3592	msedge.exe	84
PID 3592 wrote to memory of 856	3592	msedge.exe	84
PID 3592 wrote to memory of 856	3592	msedge.exe	84
PID 3592 wrote to memory of 856	3592	msedge.exe	84
PID 3592 wrote to memory of 856	3592	msedge.exe	84
PID 3592 wrote to memory of 856	3592	msedge.exe	84
PID 3592 wrote to memory of 856	3592	msedge.exe	84
PID 3592 wrote to memory of 856	3592	msedge.exe	84
PID 3592 wrote to memory of 856	3592	msedge.exe	84
PID 3592 wrote to memory of 856	3592	msedge.exe	84
PID 3592 wrote to memory of 856	3592	msedge.exe	84
PID 3592 wrote to memory of 856	3592	msedge.exe	84
PID 3592 wrote to memory of 856	3592	msedge.exe	84
PID 3592 wrote to memory of 856	3592	msedge.exe	84
PID 3592 wrote to memory of 856	3592	msedge.exe	84
PID 3592 wrote to memory of 856	3592	msedge.exe	84
PID 3592 wrote to memory of 856	3592	msedge.exe	84
PID 3592 wrote to memory of 856	3592	msedge.exe	84
PID 3592 wrote to memory of 856	3592	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\aa9df50b6ba77e6425b2d415348b824f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffeef8246f8,0x7ffeef824708,0x7ffeef824718
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2276,7558909560466893797,2135361299142277004,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2276,7558909560466893797,2135361299142277004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2276,7558909560466893797,2135361299142277004,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,7558909560466893797,2135361299142277004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,7558909560466893797,2135361299142277004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,7558909560466893797,2135361299142277004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2276,7558909560466893797,2135361299142277004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2276,7558909560466893797,2135361299142277004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,7558909560466893797,2135361299142277004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,7558909560466893797,2135361299142277004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,7558909560466893797,2135361299142277004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2276,7558909560466893797,2135361299142277004,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
08e91c5690b7d03bd5ff29abb2cf9331

SHA1
ebede4710e4c265a987769e1c733c0053887933a

SHA256
40b7ee086916107a3e10163fdc01f41c3db0f65e3272981aaaaf201960218537

SHA512
d8ba5b8e23e12178321fba1bc84bea850f3aa80cacfa2c29b28c041cb56dea24c763b4b5f2f04e31fe38a9cf4d3d9811a9f0a5ca451bc10e89120f9acf344e46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a28ef7c2b4d4586b112ed715fda45613

SHA1
4c210fcccdd98d184bab9da1d93f165f008ba7f3

SHA256
8bc136fe65fe602578b434e8db721cdfe3baa8d5c5dc7e88cc07cf813360346b

SHA512
9eba01511fee2b6d3456696f382713ea2abdd1bdfae6a52570a5005efeed1fa220ceb28552b67fb46dbf5f49eb7a81a3677c817075d0be5ccf4e725d956e9b97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5ce5061c640b4e648236f46671d97513

SHA1
ca4c64dec6fe8737b0dc1dce15d5c198ee204c84

SHA256
c4887726f49a104de41a9123d3f695a51f040c82453a6304d4aea401b23ce493

SHA512
2b8b014f007b08f0486a6e4e3fb3b4777271a8eb71d35783a46e80fa76f79bbea28dd3c27f826633b1fa1ebcf7d2ac27dfc106a9e2ba1fb9b7a9426701922993

Download Submit