17b8e898e919efa40dfccd5e4374537b00449053759f70b3fcbaa82e0c4690f5

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 07:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c6cad76cd64060e9d719c69d5f822bf_JaffaCakes118.html
Size

7KB
MD5

3c6cad76cd64060e9d719c69d5f822bf
SHA1

8465811def4efe0af29b790f48320b0036ad1511
SHA256

17b8e898e919efa40dfccd5e4374537b00449053759f70b3fcbaa82e0c4690f5
SHA512

2bb22f604f86431bcc147107d59d3b77aebf94d6f45195eb2393d466b6fd5d3520c93739ef240b7fed777c7df1587fbd7ae121fa573a88cc0674403f3df8bdf7
SSDEEP

96:uzVs+ux7ivLLY1k9o84d12ef7CSTUezMcEZ7ru7f:csz7ivAYS/sb76f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3768	msedge.exe
3768	msedge.exe
2208	msedge.exe
2208	msedge.exe
4724	identity_helper.exe
4724	identity_helper.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 4544	2208	msedge.exe	83
PID 2208 wrote to memory of 4544	2208	msedge.exe	83
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 2472	2208	msedge.exe	84
PID 2208 wrote to memory of 3768	2208	msedge.exe	85
PID 2208 wrote to memory of 3768	2208	msedge.exe	85
PID 2208 wrote to memory of 1536	2208	msedge.exe	86
PID 2208 wrote to memory of 1536	2208	msedge.exe	86
PID 2208 wrote to memory of 1536	2208	msedge.exe	86
PID 2208 wrote to memory of 1536	2208	msedge.exe	86
PID 2208 wrote to memory of 1536	2208	msedge.exe	86
PID 2208 wrote to memory of 1536	2208	msedge.exe	86
PID 2208 wrote to memory of 1536	2208	msedge.exe	86
PID 2208 wrote to memory of 1536	2208	msedge.exe	86
PID 2208 wrote to memory of 1536	2208	msedge.exe	86
PID 2208 wrote to memory of 1536	2208	msedge.exe	86
PID 2208 wrote to memory of 1536	2208	msedge.exe	86
PID 2208 wrote to memory of 1536	2208	msedge.exe	86
PID 2208 wrote to memory of 1536	2208	msedge.exe	86
PID 2208 wrote to memory of 1536	2208	msedge.exe	86
PID 2208 wrote to memory of 1536	2208	msedge.exe	86
PID 2208 wrote to memory of 1536	2208	msedge.exe	86
PID 2208 wrote to memory of 1536	2208	msedge.exe	86
PID 2208 wrote to memory of 1536	2208	msedge.exe	86
PID 2208 wrote to memory of 1536	2208	msedge.exe	86
PID 2208 wrote to memory of 1536	2208	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3c6cad76cd64060e9d719c69d5f822bf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e72246f8,0x7ff9e7224708,0x7ff9e7224718
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,8407798516271298795,8083645643707339668,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,8407798516271298795,8083645643707339668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,8407798516271298795,8083645643707339668,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8407798516271298795,8083645643707339668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8407798516271298795,8083645643707339668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,8407798516271298795,8083645643707339668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,8407798516271298795,8083645643707339668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8407798516271298795,8083645643707339668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8407798516271298795,8083645643707339668,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8407798516271298795,8083645643707339668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8407798516271298795,8083645643707339668,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,8407798516271298795,8083645643707339668,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b36c8c80421a2f5a3cd546f26e4eea5d

SHA1
9d0f11c666ea82651facdbaa1fcf090976153c0a

SHA256
99e61583654bd40d6c1b3fb046d2b774e2c7481c91b4f99567d59710c9bc5254

SHA512
07659829661a8953f37b02f8bc4cf01e5899df4953fc3ef6e698ef321ec1d1e4bd39f1835942c972b6153204a379244d5634734cb67688bb24251dc6dea470ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04ef58ac483597dd3d6c608a8f352806

SHA1
464406d060c58d58bbb9d5ef6e1449da28df74ae

SHA256
e32b1e6ac15b4583bd48ad64c880a593d4fe5c878ec89e4be593743fac713787

SHA512
55be0e63cf916bba8d33825dbb79a11b173d89feb2a2ada3b279a8887ca57c61ec5d1ad2abe9e4401d76171f725bbd0f52f2d3c3bf72cd71c6ea9e77f5a6150a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
01143cbd26f5b2011dfe3d04743437bb

SHA1
0622b69df17b5f10c4e84ec6420302bb5a344a20

SHA256
6b01dad1fb26cb6787b8993f2d004707c67d59d258d04b0daad4bf689dae8b53

SHA512
4ace0cc6c3386c82a33c89933f72a4d62be898095699a068843a05abaff3a40513105b5b8a14004679fac491e5d6c9768187f83068f82f6469af914c39c3fa7c

Download Submit