92f6d8b5887deb10f480a546123699ce700256b8a93acf8ff5ef6a5c03f51770

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ee4676581eb83837522b8c3fed4305f_JaffaCakes118.html
Size

15KB
MD5

5ee4676581eb83837522b8c3fed4305f
SHA1

2ecfe75bf99ac3cd3aa47d5d5fb36df06c38b9c4
SHA256

92f6d8b5887deb10f480a546123699ce700256b8a93acf8ff5ef6a5c03f51770
SHA512

024613cac1d876c3e2650065fa10742d9947da24dd1c019edbc9313b4603359fdbefba76d9f6cb3792fa6fcbc1989099735a0eb41ecc4be251fea73a30bc70c2
SSDEEP

384:7xNqqRo/Zm046u0LlV8hdGzESdE+OPaNRr6Gefh70P4SV79zmRPjL:7zqqRWz46u0LlV8hdGzESdE+Oi7r6Gen

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
2456	msedge.exe
2456	msedge.exe
3968	identity_helper.exe
3968	identity_helper.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 1288	2456	msedge.exe	86
PID 2456 wrote to memory of 1288	2456	msedge.exe	86
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 724	2456	msedge.exe	87
PID 2456 wrote to memory of 3432	2456	msedge.exe	88
PID 2456 wrote to memory of 3432	2456	msedge.exe	88
PID 2456 wrote to memory of 5072	2456	msedge.exe	89
PID 2456 wrote to memory of 5072	2456	msedge.exe	89
PID 2456 wrote to memory of 5072	2456	msedge.exe	89
PID 2456 wrote to memory of 5072	2456	msedge.exe	89
PID 2456 wrote to memory of 5072	2456	msedge.exe	89
PID 2456 wrote to memory of 5072	2456	msedge.exe	89
PID 2456 wrote to memory of 5072	2456	msedge.exe	89
PID 2456 wrote to memory of 5072	2456	msedge.exe	89
PID 2456 wrote to memory of 5072	2456	msedge.exe	89
PID 2456 wrote to memory of 5072	2456	msedge.exe	89
PID 2456 wrote to memory of 5072	2456	msedge.exe	89
PID 2456 wrote to memory of 5072	2456	msedge.exe	89
PID 2456 wrote to memory of 5072	2456	msedge.exe	89
PID 2456 wrote to memory of 5072	2456	msedge.exe	89
PID 2456 wrote to memory of 5072	2456	msedge.exe	89
PID 2456 wrote to memory of 5072	2456	msedge.exe	89
PID 2456 wrote to memory of 5072	2456	msedge.exe	89
PID 2456 wrote to memory of 5072	2456	msedge.exe	89
PID 2456 wrote to memory of 5072	2456	msedge.exe	89
PID 2456 wrote to memory of 5072	2456	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5ee4676581eb83837522b8c3fed4305f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeecf046f8,0x7ffeecf04708,0x7ffeecf04718
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,7471957464297701452,4422752482626095369,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,7471957464297701452,4422752482626095369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,7471957464297701452,4422752482626095369,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7471957464297701452,4422752482626095369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7471957464297701452,4422752482626095369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,7471957464297701452,4422752482626095369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,7471957464297701452,4422752482626095369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7471957464297701452,4422752482626095369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7471957464297701452,4422752482626095369,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7471957464297701452,4422752482626095369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7471957464297701452,4422752482626095369,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,7471957464297701452,4422752482626095369,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
81aa568d272e0d8bdac73a313dd976e1

SHA1
3e35dd402bc2aab650532ea95e252710611c4547

SHA256
97e5d498d2adacc8602b54cbbab8bec93d27b942489a202e2153389c698e27cc

SHA512
e5ad7f0a3288335e81d4e262bae40d6bae04921ed77cf3919d834498602ba4a36c0652a7b42a0231a704a8315b222ea4efa8d12848f8bd935fb24492f6fa1db6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2304abbe597ee2731d98a8decbfb968c

SHA1
3bbacd67a28648330c342a10a76cd28ebbb16180

SHA256
fc43ada4b3ff4d8d689de96913af447134d9297576d213ce6ffbe8202ed1cb4a

SHA512
f8bcace4a8a87e0a220ef4e547f92511a1ddd2c21e6fe7dd59e202528f0f386cc586130733dcb51fee2d105475d318a6a8558d2448eb74ca51855335a3ec831d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f14f3bc80754c0206dc21cfd9f83b3c7

SHA1
812bfb44c620b7151007c07e905af0a418606d87

SHA256
bf1b8da64fe48291c865a1eee792ec670c9b02f6c52e79ec122119febad619a8

SHA512
f3ba3be4439f5e9efb3c4cb68d0873dde7df572fd445232aa0383cd50d2c923c5f44531339f99a472760560eeff767d03ac18643723cdac9a4dcbb42e4fd1d58

Download Submit