b796a6148b24f2a39d527171ff37e04d9860036ee3ed070f7183c8b1cc7f164b

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad4e133bdd0f027f3c8052e7569f9ab3_JaffaCakes118.html
Size

35KB
MD5

ad4e133bdd0f027f3c8052e7569f9ab3
SHA1

de337eed752a5af8ea496c740e3e73dddaf939bd
SHA256

b796a6148b24f2a39d527171ff37e04d9860036ee3ed070f7183c8b1cc7f164b
SHA512

7d78b276b258a3fe634a5c604ef43893c2c5a653056b00ca41498c17b6254e1db2aeb9cfe2fff4fbe30798afbe04f41546ccf800d7a31641bde875e05c8540c9
SSDEEP

768:OdR/gsraiMW6ESza4RyQSoPS7geGlqp5/wfjfSbu0w4Q:qR/HraiMVESza48QSoPS7geOqp5/wfj1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
4824	msedge.exe
4824	msedge.exe
4444	identity_helper.exe
4444	identity_helper.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 4636	4824	msedge.exe	82
PID 4824 wrote to memory of 4636	4824	msedge.exe	82
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 4212	4824	msedge.exe	83
PID 4824 wrote to memory of 3016	4824	msedge.exe	84
PID 4824 wrote to memory of 3016	4824	msedge.exe	84
PID 4824 wrote to memory of 4612	4824	msedge.exe	85
PID 4824 wrote to memory of 4612	4824	msedge.exe	85
PID 4824 wrote to memory of 4612	4824	msedge.exe	85
PID 4824 wrote to memory of 4612	4824	msedge.exe	85
PID 4824 wrote to memory of 4612	4824	msedge.exe	85
PID 4824 wrote to memory of 4612	4824	msedge.exe	85
PID 4824 wrote to memory of 4612	4824	msedge.exe	85
PID 4824 wrote to memory of 4612	4824	msedge.exe	85
PID 4824 wrote to memory of 4612	4824	msedge.exe	85
PID 4824 wrote to memory of 4612	4824	msedge.exe	85
PID 4824 wrote to memory of 4612	4824	msedge.exe	85
PID 4824 wrote to memory of 4612	4824	msedge.exe	85
PID 4824 wrote to memory of 4612	4824	msedge.exe	85
PID 4824 wrote to memory of 4612	4824	msedge.exe	85
PID 4824 wrote to memory of 4612	4824	msedge.exe	85
PID 4824 wrote to memory of 4612	4824	msedge.exe	85
PID 4824 wrote to memory of 4612	4824	msedge.exe	85
PID 4824 wrote to memory of 4612	4824	msedge.exe	85
PID 4824 wrote to memory of 4612	4824	msedge.exe	85
PID 4824 wrote to memory of 4612	4824	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ad4e133bdd0f027f3c8052e7569f9ab3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe925646f8,0x7ffe92564708,0x7ffe92564718
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,17017547482862509877,1590266389545465450,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,17017547482862509877,1590266389545465450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,17017547482862509877,1590266389545465450,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17017547482862509877,1590266389545465450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17017547482862509877,1590266389545465450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,17017547482862509877,1590266389545465450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,17017547482862509877,1590266389545465450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17017547482862509877,1590266389545465450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17017547482862509877,1590266389545465450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17017547482862509877,1590266389545465450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17017547482862509877,1590266389545465450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,17017547482862509877,1590266389545465450,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
493B

MD5
020a4eda54b0338d54ae87a6267eab2a

SHA1
2f3a843044a87d1d72891781da3d13b9db6e747b

SHA256
688b10be247828be2ba41ac077d0a6f5147df5af7602e6d02aa81ea59da7193f

SHA512
96e93c00382afe661ca6f98abf7c5e0aecffa182f90e53df06382f739a67a9d9461249d55f24a46b64134241cbe3f0973ddda78b5fca6245e7294a45c6c54cf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44c3133841b0ee980445e25d612c7c90

SHA1
d89a4c3ec2fd5865374a395405c49e82101577cb

SHA256
924138cf00af2d4caca983c00119435fedaba9463a7d151cbd6f612b6f0e35fe

SHA512
cb5477930294a89a48c928cfde7d8e7e48a41983367a6efdff373098391b42f8912ab1209ebfedc5f8bf35d51ac47d57fda1840095244f530629792111c98966

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
38570a939623986d97c6787a13729b4e

SHA1
1c43db6141421f60ff9ea67abf39fb632d96e77f

SHA256
1d4dae29e813a2ee37e019abd181343b8cf776d73f48867f25edc9419b92ef5b

SHA512
498f295d5d0e867c6835e3a46de779041fe0ae4c43b2acc4230ab86da06778f1e5b6f14d1f109f3fb769b8e62a5576314386f9d8df67bc745fd096f1bee1841c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d2101e1668c72aa07807b4902355b65d

SHA1
75a30c557ef9ae7d1764845a517ff22026994a7d

SHA256
92c7ea219fd9d5e9cf0d8ec15b484c836b4f15846d9d736546a4bfe8f76c16df

SHA512
38ec8931fdd7ddc1e9d3ce2e60b0cf2d1031a94cd7ccff1acfbc1970f76f2acd25a321031ad69482c0a44d1c69ef1e183148f6dd410231bc2989f544ba9b89b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8b707eaa5ddddfb339cf47ee71e1a55f

SHA1
f8d263fe1423e43cca9dd863bb5d72bfa0b8e492

SHA256
63d7e7a81ca6de4722571b1e17370d635b1f2d663c036637c22dc3dad39e4999

SHA512
ee7ad654260d6f41c15fab04c1e880ad160ced7ea4aa2992c532deda7ef5ce6e79a97c4a88eb33c6d009e346ca5fe3f96d766d5dbdacaa66f3a2754f2e8b0c5e

Download Submit