d2994ee7028f60f6d6867e876b527aa8ad0617d3650950903ae616ee45ce3116

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b85f3eed2d863bfacc4fe598ef9f99e0_JaffaCakes118.html
Size

88KB
MD5

b85f3eed2d863bfacc4fe598ef9f99e0
SHA1

53a38b97b9947aabb3fd03a66fa7744511381a26
SHA256

d2994ee7028f60f6d6867e876b527aa8ad0617d3650950903ae616ee45ce3116
SHA512

8fdca4799e78ac9addc8e03ab86cb139372c039f0b43afca8dd0e3b818b5a58313005688938b5e97e0dc19620686ee0bfde334dbf829c5358be3d58b9c80180f
SSDEEP

768:89zxr4jt6Mfdc4X4UvRxSRDHxwkFk9qYpxQbhsONQMme2Tb5nndR:8Zxr4Fc4XXvRaDHHoQbbQMj2Tb5nT

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
2360	msedge.exe
2360	msedge.exe
1528	identity_helper.exe
1528	identity_helper.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1140	2360	msedge.exe	82
PID 2360 wrote to memory of 1140	2360	msedge.exe	82
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 560	2360	msedge.exe	83
PID 2360 wrote to memory of 468	2360	msedge.exe	84
PID 2360 wrote to memory of 468	2360	msedge.exe	84
PID 2360 wrote to memory of 3536	2360	msedge.exe	85
PID 2360 wrote to memory of 3536	2360	msedge.exe	85
PID 2360 wrote to memory of 3536	2360	msedge.exe	85
PID 2360 wrote to memory of 3536	2360	msedge.exe	85
PID 2360 wrote to memory of 3536	2360	msedge.exe	85
PID 2360 wrote to memory of 3536	2360	msedge.exe	85
PID 2360 wrote to memory of 3536	2360	msedge.exe	85
PID 2360 wrote to memory of 3536	2360	msedge.exe	85
PID 2360 wrote to memory of 3536	2360	msedge.exe	85
PID 2360 wrote to memory of 3536	2360	msedge.exe	85
PID 2360 wrote to memory of 3536	2360	msedge.exe	85
PID 2360 wrote to memory of 3536	2360	msedge.exe	85
PID 2360 wrote to memory of 3536	2360	msedge.exe	85
PID 2360 wrote to memory of 3536	2360	msedge.exe	85
PID 2360 wrote to memory of 3536	2360	msedge.exe	85
PID 2360 wrote to memory of 3536	2360	msedge.exe	85
PID 2360 wrote to memory of 3536	2360	msedge.exe	85
PID 2360 wrote to memory of 3536	2360	msedge.exe	85
PID 2360 wrote to memory of 3536	2360	msedge.exe	85
PID 2360 wrote to memory of 3536	2360	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b85f3eed2d863bfacc4fe598ef9f99e0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffccea246f8,0x7ffccea24708,0x7ffccea24718
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,4910942814776641528,1172324825124052979,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,4910942814776641528,1172324825124052979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,4910942814776641528,1172324825124052979,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4910942814776641528,1172324825124052979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4910942814776641528,1172324825124052979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4910942814776641528,1172324825124052979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,4910942814776641528,1172324825124052979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,4910942814776641528,1172324825124052979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4910942814776641528,1172324825124052979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4910942814776641528,1172324825124052979,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4910942814776641528,1172324825124052979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4910942814776641528,1172324825124052979,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,4910942814776641528,1172324825124052979,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
1a1d0bb6f509727d056481994db4e94d

SHA1
c8edced55d49852fb0008aa9cbf2958db29e7f0a

SHA256
8c76449717355da506a7216652f5775df65f66a5c9c078b214af444199593d94

SHA512
9d4ae27217f79c3f04b6b1483813c1d7455341b2d8d250b3e64632fc12bac95f906f499f8fb0e68515bf326fd7af1fb0464b637001e39d2770df264f6bac3a17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
98de4090da35bbc6321101a56b731360

SHA1
f5951bd929e829d27d77693ac37ce1cad41e3ca7

SHA256
9986b84f2759320897990782caed0fc4010ccc8997532105ad559c6fbfffbbaf

SHA512
cf4401ab1de2ff73c237c7ccc3ced20fe68b893c642a74d9d702b9fb2b7d966443146bd74bbed96eeb01d92f40b402c5af20b99457eeaf96e092e3969d893c99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
149a27f6461620416e84fef52d111141

SHA1
a8cf4ed6dbb0e93ae59340dd1bfa671ffce823ba

SHA256
323cd0441ce4cbecd0fbf5e4fbce39436a27a20f71eee726c05de472b9dcc8e1

SHA512
0a86017931bab0f92b1e482e75324b2d8ee0072ee02ef6ac23f97e5428de52cc5db439b04af6ce4d668916166a36b2a5810f12316f5549bc5afaa2a397d32583

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fdd8223869890d94f795cff7a9861842

SHA1
468750e5c2a70f4fffce2779c37b4c46d2342a97

SHA256
72431c61d4c8ff96fc333abc4e0759043f27cd75773431a368495896043843a5

SHA512
07379f9ef334a00d03dc3d594b73a1759892dca55c1c7fe6b1c9738db8361a41639f59960ecb32c646ace76cc26d12feb62bd13729926cbcfa9fa4e81c967584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
05433cb1d8d865db76cac43943fa010d

SHA1
5a7932f07423fb9fa7e6cedb3e7c4753a20f322b

SHA256
98d7459a711dbd43579ea2df5ceee3367dec609adb668a05abf268b9a643098a

SHA512
7b9e65698114c3e007c0ab4d39cd6f83cd3de07e4e732b4a85766edd2645c7dd91581d509eb6c5c2449d99baf083d4b6483f835ab6066cb8fc886b4913a29e5d

Download Submit