97540c6e08116831f8aa027626b62ba4c61733ee910ee16f75da8ce399ad52c3

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 10:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e01cfb1bec5e95bd4c590479d73ad6b_JaffaCakes118.html
Size

53KB
MD5

4e01cfb1bec5e95bd4c590479d73ad6b
SHA1

51f3fe607fbeac2da4ba43862aef9de8fa74bf17
SHA256

97540c6e08116831f8aa027626b62ba4c61733ee910ee16f75da8ce399ad52c3
SHA512

ce79ce76d968a41d05b70a7964ffc8d22ec7ae78fb99690057cbb20946fcfdc42c646216ce8381384b0f78551b7bf9f7773d0abd864831b8a3074ee07457eba0
SSDEEP

1536:CkgUiIakTqGivi+PyUCrunlYe63Nj+q5VyvR0w2AzTICbbSoz/t9M/dNwIUEDmD7:CkgUiIakTqGivi+PyUCrunlYe63Nj+qy

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
208	msedge.exe
208	msedge.exe
5104	identity_helper.exe
5104	identity_helper.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 2128	208	msedge.exe	83
PID 208 wrote to memory of 2128	208	msedge.exe	83
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 2884	208	msedge.exe	84
PID 208 wrote to memory of 3536	208	msedge.exe	85
PID 208 wrote to memory of 3536	208	msedge.exe	85
PID 208 wrote to memory of 3024	208	msedge.exe	86
PID 208 wrote to memory of 3024	208	msedge.exe	86
PID 208 wrote to memory of 3024	208	msedge.exe	86
PID 208 wrote to memory of 3024	208	msedge.exe	86
PID 208 wrote to memory of 3024	208	msedge.exe	86
PID 208 wrote to memory of 3024	208	msedge.exe	86
PID 208 wrote to memory of 3024	208	msedge.exe	86
PID 208 wrote to memory of 3024	208	msedge.exe	86
PID 208 wrote to memory of 3024	208	msedge.exe	86
PID 208 wrote to memory of 3024	208	msedge.exe	86
PID 208 wrote to memory of 3024	208	msedge.exe	86
PID 208 wrote to memory of 3024	208	msedge.exe	86
PID 208 wrote to memory of 3024	208	msedge.exe	86
PID 208 wrote to memory of 3024	208	msedge.exe	86
PID 208 wrote to memory of 3024	208	msedge.exe	86
PID 208 wrote to memory of 3024	208	msedge.exe	86
PID 208 wrote to memory of 3024	208	msedge.exe	86
PID 208 wrote to memory of 3024	208	msedge.exe	86
PID 208 wrote to memory of 3024	208	msedge.exe	86
PID 208 wrote to memory of 3024	208	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4e01cfb1bec5e95bd4c590479d73ad6b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7a4346f8,0x7ffe7a434708,0x7ffe7a434718
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15336777150121497846,11528213897791025111,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,15336777150121497846,11528213897791025111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,15336777150121497846,11528213897791025111,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15336777150121497846,11528213897791025111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15336777150121497846,11528213897791025111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15336777150121497846,11528213897791025111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,15336777150121497846,11528213897791025111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,15336777150121497846,11528213897791025111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15336777150121497846,11528213897791025111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15336777150121497846,11528213897791025111,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15336777150121497846,11528213897791025111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15336777150121497846,11528213897791025111,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15336777150121497846,11528213897791025111,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5720 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8dc45b70cbe29a357e2c376a0c2b751b

SHA1
25d623cea817f86b8427db53b82340410c1489b2

SHA256
511cfb6bedbad2530b5cc5538b6ec2184fc4f85947ba4c8166d0bb9f5fe2703a

SHA512
3ce0f52675feb16d6e62aae1c50767da178b93bdae28bacf6df3a2f72b8cc75b09c5092d9065e0872e5d09fd9ffe0c6931d6ae1943ddb1927b85d60659ef866e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1790c766c15938258a4f9b984cf68312

SHA1
15c9827d278d28b23a8ea0389d42fa87e404359f

SHA256
2e3978bb58c701f3c6b05de9349b7334a194591bec7bcf73f53527dc0991dc63

SHA512
2682d9c60c9d67608cf140b6ca4958d890bcbc3c8a8e95fcc639d2a11bb0ec348ca55ae99a5840e1f50e5c5bcf3e27c97fc877582d869d98cc4ea3448315aafb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
403B

MD5
d73fd0a2ef1ebb7740f23123354a5ca8

SHA1
b79b77ea49c87657d3cdf7bfd07803de4bb17714

SHA256
d8d70cf2c2a331e08de8c2658735203d9db09d3782290574dfce439273f79019

SHA512
c07e013460808e4c776864182383beeb189f78b66f92a539b26192a20b1e95703385a77020ac8a041b91461c6149c77f96cc2b4f37cc80a4c70c97ad964ab021

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
16f5462054214a54c7e87b5e9b8de8a3

SHA1
e0285851eb201bfea70ab538d04c489e2f7a6fa3

SHA256
a4ce3add0e1bb44ce493168e5613b9916ceb1ebf15d00e1883ca5c4fb18f2597

SHA512
ef27457afee72f39d407cc768b60aebcc19fe2e14f048b43916239e0e7edb8fcb22e9a95f6d6fb1cfe7c560f685fd0afac0a0ca3c451009488a0c28a3ac9d4fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
21f41c4e6c6d001932b156b36141a44f

SHA1
3505a82c85476e21ddb0b5407a77e913466f607c

SHA256
268d490aca3094c560f023f3b1ad3ff73ead4a55855536b867e59c9947486cf3

SHA512
fb21978b045d35cd948aa7f4c51b1f87972a33045c6e5735ae9558b3a09aa9216f183bbb8c6f6f6f053d5d237bf2fb42d4e77382a2ac34db2c251d12573a18cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f1cca946b398805bddc119d9a939d1c0

SHA1
8b0ade747eabb1e7d988f9824d0fc1c484d81f34

SHA256
b9305f3822fcfa10d7fadbaf476146e60ff2b50b08b258ad6f531cd84bf218a0

SHA512
85a85921b44cb1d4c4d2253c464f2788030ec5eabcd7e9c47c1796575256586a9e7b8ff22afe2b4cab3ac98127d0696646c4489ea7c2647ccaf0e6584fd595be

Download Submit