c67c5026b981e11c520c3360978177fd082529273160a663cbc31a1abe4d1e09

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2a9f12871411a9d6233dd555304f8827_JaffaCakes118.html
Size

5KB
MD5

2a9f12871411a9d6233dd555304f8827
SHA1

fb1e2cfc9e6fd17c29f13d8b9b49c7a93ee715d7
SHA256

c67c5026b981e11c520c3360978177fd082529273160a663cbc31a1abe4d1e09
SHA512

d53b26bb905712c6ccff4b25acaebfccfc96aa005c1300c6e800205e0859942ee639f2531328c51d3b24c03e7e890f7495c5afafbe4116047f5bbcfd3b7b4c93
SSDEEP

96:wq3rTMmjMzMWld5jFqnHXFIWlPrMQxT2xN9zUBHXU76SPFW:47blPAnHhlP3izgk765

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
872	msedge.exe
872	msedge.exe
224	identity_helper.exe
224	identity_helper.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 1020	872	msedge.exe	82
PID 872 wrote to memory of 1020	872	msedge.exe	82
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 804	872	msedge.exe	83
PID 872 wrote to memory of 3428	872	msedge.exe	84
PID 872 wrote to memory of 3428	872	msedge.exe	84
PID 872 wrote to memory of 5012	872	msedge.exe	85
PID 872 wrote to memory of 5012	872	msedge.exe	85
PID 872 wrote to memory of 5012	872	msedge.exe	85
PID 872 wrote to memory of 5012	872	msedge.exe	85
PID 872 wrote to memory of 5012	872	msedge.exe	85
PID 872 wrote to memory of 5012	872	msedge.exe	85
PID 872 wrote to memory of 5012	872	msedge.exe	85
PID 872 wrote to memory of 5012	872	msedge.exe	85
PID 872 wrote to memory of 5012	872	msedge.exe	85
PID 872 wrote to memory of 5012	872	msedge.exe	85
PID 872 wrote to memory of 5012	872	msedge.exe	85
PID 872 wrote to memory of 5012	872	msedge.exe	85
PID 872 wrote to memory of 5012	872	msedge.exe	85
PID 872 wrote to memory of 5012	872	msedge.exe	85
PID 872 wrote to memory of 5012	872	msedge.exe	85
PID 872 wrote to memory of 5012	872	msedge.exe	85
PID 872 wrote to memory of 5012	872	msedge.exe	85
PID 872 wrote to memory of 5012	872	msedge.exe	85
PID 872 wrote to memory of 5012	872	msedge.exe	85
PID 872 wrote to memory of 5012	872	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2a9f12871411a9d6233dd555304f8827_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc42b46f8,0x7ffcc42b4708,0x7ffcc42b4718
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,635996401916780920,4666892767016637710,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,635996401916780920,4666892767016637710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,635996401916780920,4666892767016637710,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,635996401916780920,4666892767016637710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,635996401916780920,4666892767016637710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,635996401916780920,4666892767016637710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,635996401916780920,4666892767016637710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,635996401916780920,4666892767016637710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,635996401916780920,4666892767016637710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,635996401916780920,4666892767016637710,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,635996401916780920,4666892767016637710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,635996401916780920,4666892767016637710,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,635996401916780920,4666892767016637710,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3c78617ec8f88da19254f9ff03312175

SHA1
344e9fed9434d924d1c9f05351259cbc21e434d3

SHA256
3cb47fcdca33bb3c8f4acc98424140987235ad79815da4f0e7593e4591ae90ed

SHA512
5b58675088b0fc2b2d705cb648ea89385b80c7cf908b0f4f95a9acdbd350b50754e1b586202db6a918eef70029fafb210947f3c43c570ecf7657e08939fd7e9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3f1ed6acae8625091887e0f24b3e9eca

SHA1
d2e2649e042825f857feddf58cc2f68596a80843

SHA256
276a65e8a62ec17355199d82226b4f081e63b6788b019bc25dcc9bd1a8f72292

SHA512
37e731667ee5cf3fd14603e4f5089821ea5f6ddec6a837d68142abf980994a0a0121227b59f6ead7a1ac15b73fc422696c5e4df152e4ff2eb003451e83308b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7b964cd1e5d54a26f7bea728fb0fe0ae

SHA1
76d5c5f59c91ac41d91d520b3c4cd7d69525fe40

SHA256
84037a8f1d32cc4d29fb52816fb3be24c0da2f550c657ed291c4c4707ae29ef2

SHA512
f4120c4a4210e6497baa2f271a184a890126623825578a32888099a6194be789073e81078c44170161f9a8f7f2a65990b606a785295b07e6e0efbe09efbf761d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
090bfcbcfbe42ebde7671bc052577734

SHA1
787c9189eab154010d956698210cb5c4893bade0

SHA256
ecdcd12015d6c434d0e74c16175a3e1778a71610a209127bc2ead75263d6b971

SHA512
db705ecb932973a13f93652a6c045b775e8edc7acd0588d34fe636cccad4da0a527c18461840be7731f01a69aa57fe917451415743cb24b3733de49e73a8283b

Download Submit