9cf088f9bace3cffdcc1209ccbab6ad1e3537c2008b1b523dbc032adf064e38d

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afbcd5642912d0b7eb297e39e42e8ee0_JaffaCakes118.html
Size

2KB
MD5

afbcd5642912d0b7eb297e39e42e8ee0
SHA1

5fe36b53a8c6c3e2b68238284fed9541b9acb8cc
SHA256

9cf088f9bace3cffdcc1209ccbab6ad1e3537c2008b1b523dbc032adf064e38d
SHA512

b3073d432db8028502e545684999fedc5450acd0f9bb1ef6eb25e77f117fccf599cf232c5ef8e3ea3ac8d3234b4ec3c9738fac5d3206f8262e2f1cc1f7ed2850

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
2296	msedge.exe
2296	msedge.exe
408	identity_helper.exe
408	identity_helper.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 4824	2296	msedge.exe	81
PID 2296 wrote to memory of 4824	2296	msedge.exe	81
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 872	2296	msedge.exe	82
PID 2296 wrote to memory of 208	2296	msedge.exe	83
PID 2296 wrote to memory of 208	2296	msedge.exe	83
PID 2296 wrote to memory of 1040	2296	msedge.exe	84
PID 2296 wrote to memory of 1040	2296	msedge.exe	84
PID 2296 wrote to memory of 1040	2296	msedge.exe	84
PID 2296 wrote to memory of 1040	2296	msedge.exe	84
PID 2296 wrote to memory of 1040	2296	msedge.exe	84
PID 2296 wrote to memory of 1040	2296	msedge.exe	84
PID 2296 wrote to memory of 1040	2296	msedge.exe	84
PID 2296 wrote to memory of 1040	2296	msedge.exe	84
PID 2296 wrote to memory of 1040	2296	msedge.exe	84
PID 2296 wrote to memory of 1040	2296	msedge.exe	84
PID 2296 wrote to memory of 1040	2296	msedge.exe	84
PID 2296 wrote to memory of 1040	2296	msedge.exe	84
PID 2296 wrote to memory of 1040	2296	msedge.exe	84
PID 2296 wrote to memory of 1040	2296	msedge.exe	84
PID 2296 wrote to memory of 1040	2296	msedge.exe	84
PID 2296 wrote to memory of 1040	2296	msedge.exe	84
PID 2296 wrote to memory of 1040	2296	msedge.exe	84
PID 2296 wrote to memory of 1040	2296	msedge.exe	84
PID 2296 wrote to memory of 1040	2296	msedge.exe	84
PID 2296 wrote to memory of 1040	2296	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\afbcd5642912d0b7eb297e39e42e8ee0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe85ef46f8,0x7ffe85ef4708,0x7ffe85ef4718
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,7554567156291278437,8563691190557000604,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,7554567156291278437,8563691190557000604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,7554567156291278437,8563691190557000604,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7554567156291278437,8563691190557000604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7554567156291278437,8563691190557000604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7554567156291278437,8563691190557000604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7554567156291278437,8563691190557000604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,7554567156291278437,8563691190557000604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,7554567156291278437,8563691190557000604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7554567156291278437,8563691190557000604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7554567156291278437,8563691190557000604,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7554567156291278437,8563691190557000604,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,7554567156291278437,8563691190557000604,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
baef2c2d29abe625cb7afec6f89e0d18

SHA1
0e205a97e61588957556884fe36a838ad4a2f547

SHA256
7e02fd591551361dead626438b5d7cfc2f1c545ff4f297926cf96d3f53a52c4e

SHA512
c04d6d54079606a945818d72d491afef4b7e1ddb06721b6c04890bcf8406fa177b64a39940a7010a2126e8b99d9e71013dbee402965b01bca6b6920526779caf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b296cd24bcf6b3b2752dc638acf1bcc1

SHA1
04135db2371a3bca506fdf5dcd824cf40e3c11c8

SHA256
8bfcb50ba93d775a93e1c25198adae4b0ee548ac945a088b46e91fe4ae894285

SHA512
8493e96ff9be4c94f805b46e5b0b80b0d920c808c2ed64f5d1cc1b2509419276a5fc776e03d7fcce8e29afd60176864daf756d6addce3246fea81cf03c76c082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9ad2cacef4054d01f53017d8cc58f30b

SHA1
3fc09021e9c2df85051e60406f174fa1b76493a7

SHA256
6c4cbfc5ea5d9a4726ab7f3b81f6ccbfd0b25c18fb399042b4c2f4b2913bb0df

SHA512
6c22725d040beadd5e91f232f2b92b1f7c276180c8e244cae0d70b4f0f5d4f515db75961ac43345d82e594de165a376e0cb243d70a2b7b768b2016b206c7ca40

Download Submit