d7df3746c6a0d87bbd6484290aa1f15a4ec68da4eb49c3c6116002ad30dae5fb

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60698844244320fe935e7557d82c388e_JaffaCakes118.html
Size

11KB
MD5

60698844244320fe935e7557d82c388e
SHA1

ee5ff79e59ca8039a3684c9ace9717357f6a7bf5
SHA256

d7df3746c6a0d87bbd6484290aa1f15a4ec68da4eb49c3c6116002ad30dae5fb
SHA512

0876a820d93cdfa6b53b42849694895a20812ab354463fa8ac609e0d113391e9fc837be123c0a054539ec325ace3e2b33f98acd197dbc38bb1f911421cd63583
SSDEEP

192:2ValIsr0r57MQxLT8g/w1wvqLkt1OmvLuBuLbdU8d:salIcIQQxH/gqOmzguLZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
3960	msedge.exe
3960	msedge.exe
2716	identity_helper.exe
2716	identity_helper.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 1708	3960	msedge.exe	84
PID 3960 wrote to memory of 1708	3960	msedge.exe	84
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 264	3960	msedge.exe	85
PID 3960 wrote to memory of 2016	3960	msedge.exe	86
PID 3960 wrote to memory of 2016	3960	msedge.exe	86
PID 3960 wrote to memory of 3996	3960	msedge.exe	87
PID 3960 wrote to memory of 3996	3960	msedge.exe	87
PID 3960 wrote to memory of 3996	3960	msedge.exe	87
PID 3960 wrote to memory of 3996	3960	msedge.exe	87
PID 3960 wrote to memory of 3996	3960	msedge.exe	87
PID 3960 wrote to memory of 3996	3960	msedge.exe	87
PID 3960 wrote to memory of 3996	3960	msedge.exe	87
PID 3960 wrote to memory of 3996	3960	msedge.exe	87
PID 3960 wrote to memory of 3996	3960	msedge.exe	87
PID 3960 wrote to memory of 3996	3960	msedge.exe	87
PID 3960 wrote to memory of 3996	3960	msedge.exe	87
PID 3960 wrote to memory of 3996	3960	msedge.exe	87
PID 3960 wrote to memory of 3996	3960	msedge.exe	87
PID 3960 wrote to memory of 3996	3960	msedge.exe	87
PID 3960 wrote to memory of 3996	3960	msedge.exe	87
PID 3960 wrote to memory of 3996	3960	msedge.exe	87
PID 3960 wrote to memory of 3996	3960	msedge.exe	87
PID 3960 wrote to memory of 3996	3960	msedge.exe	87
PID 3960 wrote to memory of 3996	3960	msedge.exe	87
PID 3960 wrote to memory of 3996	3960	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\60698844244320fe935e7557d82c388e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae4c846f8,0x7ffae4c84708,0x7ffae4c84718
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,7224630396117701284,17285829127263467657,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,7224630396117701284,17285829127263467657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,7224630396117701284,17285829127263467657,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7224630396117701284,17285829127263467657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7224630396117701284,17285829127263467657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7224630396117701284,17285829127263467657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,7224630396117701284,17285829127263467657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,7224630396117701284,17285829127263467657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7224630396117701284,17285829127263467657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7224630396117701284,17285829127263467657,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7224630396117701284,17285829127263467657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7224630396117701284,17285829127263467657,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,7224630396117701284,17285829127263467657,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6136 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
dba95fde05b468f35841deeb60b9d977

SHA1
94b28c851336ba0207a8e53bbcbc9e749fad8195

SHA256
e6277d0b76b71ba3d2b4e38ba1882e1537ec10fe0643556b7d7413a43e481be5

SHA512
44d289530810e24290fe4769024eeb4b57bd9a6383f384b86bc3065b93326920008c8abad96b935f229bf19748d1c52d6a94510566951f0ded23ff2cfed25625

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
cf20519f83ac445d0125547a1defd94f

SHA1
ea36280b89083ab27da07d17aa1763d7bd1af03a

SHA256
60eb3e0b4d29e6dfbc0ed625e7220e63124f007aafbb08f7b3b1c8ee8257567c

SHA512
4504ab81c6f7c72fcd822139b8c15182d50ceb5128a4656b06451b453a7952050e5a92477b20a1dabfebd9549fc8ad93b5d3faa9c6239aadda03fb9e24b293a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
886b579fb799845a684f9459263bc947

SHA1
e40a9d2f8badfa5ab9785112729603fc645a0e16

SHA256
5ac42930a351ffa86278290a36fb64f341817ae84c4bc0b7ecb5817992d0283f

SHA512
a85885e3e6024eef8f40c2ed92df16a7bd7fb5cbbab59567d23c90bd6af3922d4238a16e2c712aadb1be1ac564ac0c047c38890fd9b682ccdca7ca1e7497d979

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d0fe48f97d6522a161e327f70e35441d

SHA1
651965ab3bb87a2dee82d8bc02088771bc5bd7aa

SHA256
39f40cf4b9803b0a1cd48b48edff59a98ad7b7039edd0cd237f33fa13deb0d95

SHA512
73f9ea04ea408fb422c5f2121cbaee0b8e89c72c744146a9408bf1b90cd5869111da9cc39c9496bdd4497c5ebc31a96a519326a1d15d7af608ee945392888f44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c772a95d083641ec9538de2b5f9be12a

SHA1
2e1bc58736fcf514c5fbd679d256aecfcc86299f

SHA256
abdc7c68becea89029544579c0931d0b775336194878e35f385c544fabda28a3

SHA512
b0b348a4d75ab16c20936a048839ce63e2657c53bd1309ea4270d6abaf69c81f41e5fcebc822fc3d913e8f1086b1f7b78be941c9bea08ddee4f5670574ff98b2

Download Submit