2f4dbd13021602700b9c4d0b6b76e8b8c01d7e1f200008b5daedbec634f8274a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5af12dceb49622bff7d74b99cc838686_JaffaCakes118.html
Size

31KB
MD5

5af12dceb49622bff7d74b99cc838686
SHA1

2c2b05137d7bd1a0cc1687d6e3e7405b468b7fb5
SHA256

2f4dbd13021602700b9c4d0b6b76e8b8c01d7e1f200008b5daedbec634f8274a
SHA512

3d3e6b0d61b3176703a88ca8d142819d0c020c25f55c33f4b4c207db29f86bd3cdb97ba1467b43e9dc7fdd89a63be40d0a988ce1384faef36ef1504e3f13dd08
SSDEEP

384:Jda4V/HkloM7QnznnnNvNyLfNvNyGn9RNvNy1nnrNvNyYnnDNvNysnnlNvNyAnnT:JtV+QnznOn9gnVnRnTnV9Kihg50vt

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
5028	msedge.exe
5028	msedge.exe
3192	identity_helper.exe
3192	identity_helper.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 3804	5028	msedge.exe	84
PID 5028 wrote to memory of 3804	5028	msedge.exe	84
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 640	5028	msedge.exe	85
PID 5028 wrote to memory of 4932	5028	msedge.exe	86
PID 5028 wrote to memory of 4932	5028	msedge.exe	86
PID 5028 wrote to memory of 4288	5028	msedge.exe	87
PID 5028 wrote to memory of 4288	5028	msedge.exe	87
PID 5028 wrote to memory of 4288	5028	msedge.exe	87
PID 5028 wrote to memory of 4288	5028	msedge.exe	87
PID 5028 wrote to memory of 4288	5028	msedge.exe	87
PID 5028 wrote to memory of 4288	5028	msedge.exe	87
PID 5028 wrote to memory of 4288	5028	msedge.exe	87
PID 5028 wrote to memory of 4288	5028	msedge.exe	87
PID 5028 wrote to memory of 4288	5028	msedge.exe	87
PID 5028 wrote to memory of 4288	5028	msedge.exe	87
PID 5028 wrote to memory of 4288	5028	msedge.exe	87
PID 5028 wrote to memory of 4288	5028	msedge.exe	87
PID 5028 wrote to memory of 4288	5028	msedge.exe	87
PID 5028 wrote to memory of 4288	5028	msedge.exe	87
PID 5028 wrote to memory of 4288	5028	msedge.exe	87
PID 5028 wrote to memory of 4288	5028	msedge.exe	87
PID 5028 wrote to memory of 4288	5028	msedge.exe	87
PID 5028 wrote to memory of 4288	5028	msedge.exe	87
PID 5028 wrote to memory of 4288	5028	msedge.exe	87
PID 5028 wrote to memory of 4288	5028	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5af12dceb49622bff7d74b99cc838686_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d09246f8,0x7ff8d0924708,0x7ff8d0924718
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3161071344652903567,10427749374610046491,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,3161071344652903567,10427749374610046491,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,3161071344652903567,10427749374610046491,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3161071344652903567,10427749374610046491,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3161071344652903567,10427749374610046491,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,3161071344652903567,10427749374610046491,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,3161071344652903567,10427749374610046491,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3161071344652903567,10427749374610046491,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3161071344652903567,10427749374610046491,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3161071344652903567,10427749374610046491,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3161071344652903567,10427749374610046491,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3161071344652903567,10427749374610046491,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
641B

MD5
66ad2476c450e4e9b986edcfcfdc15c1

SHA1
53a709d214bf9be0b9d9c7abe073339f0df25b39

SHA256
4c00821779b2465598bb7923df9c5651eca31ed151326b1106b459cded9f85c1

SHA512
e7c36b814d5e2ce80d4707433b857f3e27072051aa31e83f5687c7f34e1924a3ab6e32e3f0d4c20adbbb41990c3c310a0cbd4b9ba742983df929126094554af6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e9051d027c17eaeedec2cc4c9442acae

SHA1
0822b06294e066b8ab8842d4f098d844ad469b0f

SHA256
2e2122dbf91f197955b1ab09dc5cd7cd2ba7c914f5e0b5dd4a08fcc8019a849a

SHA512
cf0cb7de8c655a9b78efbd13f59ab391e91dbd8e0db4e41c01c0d620d6a247280c9ec3d7baf04bafd8c545205f6c8701bd10a4749444956151eea9c4b2372f93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f85359b1ff176e2c8184920f1d01eba

SHA1
870c60cec07b391e4af8c52f3cfb16dffa1c0bf1

SHA256
ab2bdf478684346e8f71921ae531525488e299840d720ebc9f8c0df088ea4523

SHA512
957eb2ca07d557e6f07b1f4ddb077d33c96d1e94fc6e38726e57e698075da5fdd8eb86677abf33d3fc9ab731c7d1101316d00c99033c7c7fd4feeb645f073636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d4e0ad808032b2c659b99397839ee36f

SHA1
a566931938f69a8bfbe9b35f998b4346876124f0

SHA256
e6f2e04fd0ddc30fb952dbf9e7f724986203c10c99b7de457086be03a835c4db

SHA512
936db8e9066bae6ef9eb94bdca2b360d590d41d6f6a8cfa38f7e6d86dfb3b549ea7f67d880061124ab2d74f2589b52422207d9cd03f0d29148253f72b421d7d2

Download Submit