a73dffcc6727dc7a3e21853d5af4092d3ddf52d24d4571f13d8a22d0da0f0a34

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ce0bbfb95d0525d1912cc1ff97ed509_JaffaCakes118.html
Size

19KB
MD5

5ce0bbfb95d0525d1912cc1ff97ed509
SHA1

d60c078474de96a6911adde3cffe3e40a8560417
SHA256

a73dffcc6727dc7a3e21853d5af4092d3ddf52d24d4571f13d8a22d0da0f0a34
SHA512

e3f83f33fa924dd2c656302577e05b56f48285816c3ded6e4ea5344ad44aab81d1df2684db05c501cf98cea347e9b2b62d0e618e2c30fd4e28096a8a23f88cfe
SSDEEP

384:RGGji6QlTT3FjhzBvMU43/K9d78iO9TE2tW:8GjGl3FMF3/Kjg1W

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
3872	msedge.exe
3872	msedge.exe
4656	identity_helper.exe
4656	identity_helper.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 3372	3872	msedge.exe	84
PID 3872 wrote to memory of 3372	3872	msedge.exe	84
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 456	3872	msedge.exe	85
PID 3872 wrote to memory of 1416	3872	msedge.exe	86
PID 3872 wrote to memory of 1416	3872	msedge.exe	86
PID 3872 wrote to memory of 2084	3872	msedge.exe	87
PID 3872 wrote to memory of 2084	3872	msedge.exe	87
PID 3872 wrote to memory of 2084	3872	msedge.exe	87
PID 3872 wrote to memory of 2084	3872	msedge.exe	87
PID 3872 wrote to memory of 2084	3872	msedge.exe	87
PID 3872 wrote to memory of 2084	3872	msedge.exe	87
PID 3872 wrote to memory of 2084	3872	msedge.exe	87
PID 3872 wrote to memory of 2084	3872	msedge.exe	87
PID 3872 wrote to memory of 2084	3872	msedge.exe	87
PID 3872 wrote to memory of 2084	3872	msedge.exe	87
PID 3872 wrote to memory of 2084	3872	msedge.exe	87
PID 3872 wrote to memory of 2084	3872	msedge.exe	87
PID 3872 wrote to memory of 2084	3872	msedge.exe	87
PID 3872 wrote to memory of 2084	3872	msedge.exe	87
PID 3872 wrote to memory of 2084	3872	msedge.exe	87
PID 3872 wrote to memory of 2084	3872	msedge.exe	87
PID 3872 wrote to memory of 2084	3872	msedge.exe	87
PID 3872 wrote to memory of 2084	3872	msedge.exe	87
PID 3872 wrote to memory of 2084	3872	msedge.exe	87
PID 3872 wrote to memory of 2084	3872	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5ce0bbfb95d0525d1912cc1ff97ed509_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe225346f8,0x7ffe22534708,0x7ffe22534718
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,14456676412342779773,18179020862421692167,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,14456676412342779773,18179020862421692167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,14456676412342779773,18179020862421692167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14456676412342779773,18179020862421692167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14456676412342779773,18179020862421692167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14456676412342779773,18179020862421692167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14456676412342779773,18179020862421692167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,14456676412342779773,18179020862421692167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,14456676412342779773,18179020862421692167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14456676412342779773,18179020862421692167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14456676412342779773,18179020862421692167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14456676412342779773,18179020862421692167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14456676412342779773,18179020862421692167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,14456676412342779773,18179020862421692167,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
3ae3b38577c7518fe0916d0c9d7898b5

SHA1
562872508d0fd1a5d952179444950b31a8fc996b

SHA256
5c1e8a7a99cae18869d985ffde10125e0406611a5e07c442e15a7b60202cd2c4

SHA512
524d1167501f2454bf2d0496a594e02786dec641793ceb0f9f43d1f53ef3f1289b621c5e737e8b27cd10ca01731ec838c645998397c0089b94c54e6bd998b4a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
a61c65068d54ec293c4186b9fead2a98

SHA1
e414788aaabab2a59037974b0c65231effb61252

SHA256
347f4a3874198fd1ece751e4422d2e6425f7388086c8136440302074ce5c83d3

SHA512
1c7074d06eecd705ae0a27ae6663346297c04c518d7246e938ebd648833ce2372083611d205b1ffddf8972890370a022a82c24332965f9266ee72eb3a2e74e04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8dc45b70cbe29a357e2c376a0c2b751b

SHA1
25d623cea817f86b8427db53b82340410c1489b2

SHA256
511cfb6bedbad2530b5cc5538b6ec2184fc4f85947ba4c8166d0bb9f5fe2703a

SHA512
3ce0f52675feb16d6e62aae1c50767da178b93bdae28bacf6df3a2f72b8cc75b09c5092d9065e0872e5d09fd9ffe0c6931d6ae1943ddb1927b85d60659ef866e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1790c766c15938258a4f9b984cf68312

SHA1
15c9827d278d28b23a8ea0389d42fa87e404359f

SHA256
2e3978bb58c701f3c6b05de9349b7334a194591bec7bcf73f53527dc0991dc63

SHA512
2682d9c60c9d67608cf140b6ca4958d890bcbc3c8a8e95fcc639d2a11bb0ec348ca55ae99a5840e1f50e5c5bcf3e27c97fc877582d869d98cc4ea3448315aafb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
928B

MD5
fae30acca13c0fdb92d486e3d22d0d7a

SHA1
1753c6f3a5fb1b5315886c94480a1ac3e0738aec

SHA256
e4a9d1f30249a91c3ba402706cfe8a4c335f02dd0c253321cce7a6bf2e103aec

SHA512
03705bf7baf85520c0c197f94c67df5cf65c1c8f1ad9dae2072359302a5631c16c32e5f8b2ce7be10dfdbab2125910db925947978d3551aca96a4ed2fbd4a157

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a0da1894951e24415c2c27a96a57cfc6

SHA1
64ea3ab7b5d35db83088932bef2d16bc71b99517

SHA256
904920848da836f50d30d1a4809042643e4de9baae50b38396a3480278b786e1

SHA512
7d55865b48ffafe8b554726a48f5c517d7b766d2e2d602600f285c73ffd8d01de5a1af18326a260817cdf1fc7921abf06f7c30e7a858f66edcb5bb25d4159781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
09c7e3aae508de77a8f5dafe10eedd12

SHA1
2e5da624aa83e8356bb5351b8f00b9a9d61a00a8

SHA256
0085d23801a5a57386f89bb874f6485f4714172c995663ba28da3a7a4173227a

SHA512
da0767951cac3d45509c1ae24628a4906290f533b99fb490e14b87d951b4b94eec636d5072bd52e6df75f090663314d01ecafdced7e28c3248f7b9b839657618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
133a32ad40e56eea93a0fc656fd2d5d4

SHA1
406453c827605fc024d8011ecbd6f338c86bf666

SHA256
1922a2c7c1b83330cefffa8f72f7854eff7c902163dd81dbf75b595c14d37495

SHA512
cb1b2205193210d5496a739d4432b4364fd03d30e853eebbd13695f57d0247a6f1a48ec1a27e4526a39871c821164901332ccbeb00881792dcfa60f9724e86a4

Download Submit