185a0ece390a22b22a89e3ae8de2d4e9e961e6356df344a4699bde9c39f0655b

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6725d00cb78421bae48b502b6fc0f473_JaffaCakes118.html
Size

104KB
MD5

6725d00cb78421bae48b502b6fc0f473
SHA1

cdb7a9dc978b4465e6c6fe3fc85bbfac5e8070aa
SHA256

185a0ece390a22b22a89e3ae8de2d4e9e961e6356df344a4699bde9c39f0655b
SHA512

79467a882b45ca5627ba89ebea5ef4b1a40e1a5ec57239d006a2f9b62eb04557285e31b79d6dd0d5e4a6dc9288f8d6d7305b88397b0c745b0aca34b5d91f0c70
SSDEEP

1536:SASW7zQUIBQlUsk1urmRACKzZ2wQzRLkFZWJRigGEFhH2csw:SAS8FMu6OClTzRCIigGQH2cF

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
3700	msedge.exe
3700	msedge.exe
3924	identity_helper.exe
3924	identity_helper.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 3200	3700	msedge.exe	84
PID 3700 wrote to memory of 3200	3700	msedge.exe	84
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 1100	3700	msedge.exe	85
PID 3700 wrote to memory of 224	3700	msedge.exe	86
PID 3700 wrote to memory of 224	3700	msedge.exe	86
PID 3700 wrote to memory of 4596	3700	msedge.exe	87
PID 3700 wrote to memory of 4596	3700	msedge.exe	87
PID 3700 wrote to memory of 4596	3700	msedge.exe	87
PID 3700 wrote to memory of 4596	3700	msedge.exe	87
PID 3700 wrote to memory of 4596	3700	msedge.exe	87
PID 3700 wrote to memory of 4596	3700	msedge.exe	87
PID 3700 wrote to memory of 4596	3700	msedge.exe	87
PID 3700 wrote to memory of 4596	3700	msedge.exe	87
PID 3700 wrote to memory of 4596	3700	msedge.exe	87
PID 3700 wrote to memory of 4596	3700	msedge.exe	87
PID 3700 wrote to memory of 4596	3700	msedge.exe	87
PID 3700 wrote to memory of 4596	3700	msedge.exe	87
PID 3700 wrote to memory of 4596	3700	msedge.exe	87
PID 3700 wrote to memory of 4596	3700	msedge.exe	87
PID 3700 wrote to memory of 4596	3700	msedge.exe	87
PID 3700 wrote to memory of 4596	3700	msedge.exe	87
PID 3700 wrote to memory of 4596	3700	msedge.exe	87
PID 3700 wrote to memory of 4596	3700	msedge.exe	87
PID 3700 wrote to memory of 4596	3700	msedge.exe	87
PID 3700 wrote to memory of 4596	3700	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6725d00cb78421bae48b502b6fc0f473_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d53d46f8,0x7ff9d53d4708,0x7ff9d53d4718
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,3593480056420953675,11032318101513947052,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,3593480056420953675,11032318101513947052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,3593480056420953675,11032318101513947052,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3593480056420953675,11032318101513947052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3593480056420953675,11032318101513947052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,3593480056420953675,11032318101513947052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,3593480056420953675,11032318101513947052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3593480056420953675,11032318101513947052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3593480056420953675,11032318101513947052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3593480056420953675,11032318101513947052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3593480056420953675,11032318101513947052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,3593480056420953675,11032318101513947052,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
568B

MD5
735f00edea256c8444d3e26809db53fe

SHA1
5ab720d10920955e5716353af89ccec3912b9ec0

SHA256
cb597a91d2c0b40c49937ca35743c31a4b5554fdce700c3f87377ee18975d281

SHA512
792f21d71acd4bffe626f3b37fdc0bde3badcf9cc70ab5d8ec438e1898d3f5d8f77b410515da4d4fa248036db6f878911574fbbb1f7a31a3e478fb1338316014

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3a02462ab5d2edb1c171a5c808819ed5

SHA1
9698b30ac0e4dfbae7d01ef258372a70ba91dce9

SHA256
0ea7a63f85ecf912623f22ecf8ea0d75517b625cb52cd47432b2b1ca22ed87dc

SHA512
f1814813764503e3bad9e472b100849d0dfcc6d621a4f565e07cc76d79e81133cc47feefea75c13eb911b7c4db02496ff9caf85828849f77bbbcf7ce6db96014

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c6348c7711b264bc6a5094dc4e74bd12

SHA1
43e65d31e4ea65608b87ffd38f7dc0348dd3aad6

SHA256
93684cd9b42b438394f25385baa373f595faca34cbae96cea5fb1cc8a8351cca

SHA512
9b6ecfdeb105b2347510b9e07de9a71137f6a8be09e54564167ddad0cfe4dd489eeb2f69f2bb193d1b2dcf3d90d62e9973b4da1bb113aa2e85d43ea129ea1329

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b82c72f0f1f3b93ef03c448d9be4a9d2

SHA1
d6466a4277740183cbfe1ca3d3d615ac3783f551

SHA256
5fb69a9be5fa2ca49f7b74f72e769377e26e54be130d0e0142f6f9c9f1c7184b

SHA512
f8d9f0b9fc686cdf9e5db86c9d507319a06ab24c02ff32c90ad12c8b62d53edffd9cf9192ffdf0f112db99736002858725fcf5bd8828b28ddd1ca3dad1eaa32f

Download Submit