184ee9b91edc6c7b9155e7cacd914872f600d462a73809099ce4fb85aee77d4b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

465b9fcaf722df037b26a4ade53d4a21_JaffaCakes118.html
Size

6KB
MD5

465b9fcaf722df037b26a4ade53d4a21
SHA1

eccbb2bf9e26ca3934978bdb08bdd356f1ecb26e
SHA256

184ee9b91edc6c7b9155e7cacd914872f600d462a73809099ce4fb85aee77d4b
SHA512

b148c362cac743043e1021dc9d71d513352b94b3b076000441da5953c296c528ab0b8180a3b7fb793da961becdbcc54d8b21e8a6e0fffc23c79209725bffbb32
SSDEEP

96:uzVs+ux7OrOLLY1k9o84d12ef7CSTUSZcEZ7ru7f:csz7OrOAYS/Rb76f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe
1924	msedge.exe
1924	msedge.exe
1860	identity_helper.exe
1860	identity_helper.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1448	1924	msedge.exe	83
PID 1924 wrote to memory of 1448	1924	msedge.exe	83
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 2788	1924	msedge.exe	84
PID 1924 wrote to memory of 4196	1924	msedge.exe	85
PID 1924 wrote to memory of 4196	1924	msedge.exe	85
PID 1924 wrote to memory of 1368	1924	msedge.exe	86
PID 1924 wrote to memory of 1368	1924	msedge.exe	86
PID 1924 wrote to memory of 1368	1924	msedge.exe	86
PID 1924 wrote to memory of 1368	1924	msedge.exe	86
PID 1924 wrote to memory of 1368	1924	msedge.exe	86
PID 1924 wrote to memory of 1368	1924	msedge.exe	86
PID 1924 wrote to memory of 1368	1924	msedge.exe	86
PID 1924 wrote to memory of 1368	1924	msedge.exe	86
PID 1924 wrote to memory of 1368	1924	msedge.exe	86
PID 1924 wrote to memory of 1368	1924	msedge.exe	86
PID 1924 wrote to memory of 1368	1924	msedge.exe	86
PID 1924 wrote to memory of 1368	1924	msedge.exe	86
PID 1924 wrote to memory of 1368	1924	msedge.exe	86
PID 1924 wrote to memory of 1368	1924	msedge.exe	86
PID 1924 wrote to memory of 1368	1924	msedge.exe	86
PID 1924 wrote to memory of 1368	1924	msedge.exe	86
PID 1924 wrote to memory of 1368	1924	msedge.exe	86
PID 1924 wrote to memory of 1368	1924	msedge.exe	86
PID 1924 wrote to memory of 1368	1924	msedge.exe	86
PID 1924 wrote to memory of 1368	1924	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\465b9fcaf722df037b26a4ade53d4a21_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd850046f8,0x7ffd85004708,0x7ffd85004718
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,12270892703826399126,4972445330683080480,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,12270892703826399126,4972445330683080480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,12270892703826399126,4972445330683080480,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12270892703826399126,4972445330683080480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12270892703826399126,4972445330683080480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,12270892703826399126,4972445330683080480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,12270892703826399126,4972445330683080480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12270892703826399126,4972445330683080480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12270892703826399126,4972445330683080480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12270892703826399126,4972445330683080480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12270892703826399126,4972445330683080480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,12270892703826399126,4972445330683080480,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1304 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
80b9776ccf049823814ea022472f0ff7

SHA1
466ed2b227672392d27cae35468600fe69daa2db

SHA256
a01f663769fd2a896a1f99429829dfc21a203e7f3528534536bff78fbe159f98

SHA512
616df5dafafec412ca2104077f8849382896a4cf0347e54f8d87c28a80d18506c9c42981d972632f93b454a7014d83f2bb35f1ac70a3db3c4640a275b2a177a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b5995fe97067e041a8a65dae177498f

SHA1
f602b8637b5850f10c12094863887c044a30c641

SHA256
499e9c105894734db04879082d75b79fa1cb1ac28ac8da8f8df0ff5cdc2f0b3c

SHA512
0e4fa09e070366d309e42014e3b84b31251ddae857e5211f1697bc93509fbc81736fdfd547e499747f3f6ba87a1ffead8292d4a550eb6eec136d91fac49c10bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4d702975bfcc22fad69905fdd49fa47d

SHA1
78df25fcf1c726528f5ea6f3bfd0f3c3b8b61a58

SHA256
80591d5e4296e54133c41c6678bd80811f5950ab67c0916885177b21d29d5546

SHA512
e2dfeeb2f70b0c2c33df0523bbfa933088a15de415059b83009187b5012b3fb95b66f6113bd59f74a3199bb55af27f0224e7144811e1d0d54b74db19a73607fd

Download Submit