e21b70867f8e9084b6bb3fdf0561e971c1e8b1a51ddb76dec736750e34e505c7

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ad3073ed4a96f5e23a6b7a6f17d6da4_JaffaCakes118.html
Size

202KB
MD5

2ad3073ed4a96f5e23a6b7a6f17d6da4
SHA1

a231ef445e7fa9d69ddafe7d0575cf856ff7d3ce
SHA256

e21b70867f8e9084b6bb3fdf0561e971c1e8b1a51ddb76dec736750e34e505c7
SHA512

78599e0cda73869cab99c4effcd810b664b5a960e6d898973348f7b3f5d7a2589f6a8956a3f7c579ceef2a7fd3251d7352e03ebe795bbca5470a04985fef2e38
SSDEEP

1536:kaWijpAWVT93qJOypA3GcgQOZ6l5wh2xTqKiQaQGvM:dWsBV

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
2608	msedge.exe
2608	msedge.exe
2400	identity_helper.exe
2400	identity_helper.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 1600	2608	msedge.exe	86
PID 2608 wrote to memory of 1600	2608	msedge.exe	86
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 2740	2608	msedge.exe	87
PID 2608 wrote to memory of 4548	2608	msedge.exe	88
PID 2608 wrote to memory of 4548	2608	msedge.exe	88
PID 2608 wrote to memory of 1168	2608	msedge.exe	89
PID 2608 wrote to memory of 1168	2608	msedge.exe	89
PID 2608 wrote to memory of 1168	2608	msedge.exe	89
PID 2608 wrote to memory of 1168	2608	msedge.exe	89
PID 2608 wrote to memory of 1168	2608	msedge.exe	89
PID 2608 wrote to memory of 1168	2608	msedge.exe	89
PID 2608 wrote to memory of 1168	2608	msedge.exe	89
PID 2608 wrote to memory of 1168	2608	msedge.exe	89
PID 2608 wrote to memory of 1168	2608	msedge.exe	89
PID 2608 wrote to memory of 1168	2608	msedge.exe	89
PID 2608 wrote to memory of 1168	2608	msedge.exe	89
PID 2608 wrote to memory of 1168	2608	msedge.exe	89
PID 2608 wrote to memory of 1168	2608	msedge.exe	89
PID 2608 wrote to memory of 1168	2608	msedge.exe	89
PID 2608 wrote to memory of 1168	2608	msedge.exe	89
PID 2608 wrote to memory of 1168	2608	msedge.exe	89
PID 2608 wrote to memory of 1168	2608	msedge.exe	89
PID 2608 wrote to memory of 1168	2608	msedge.exe	89
PID 2608 wrote to memory of 1168	2608	msedge.exe	89
PID 2608 wrote to memory of 1168	2608	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2ad3073ed4a96f5e23a6b7a6f17d6da4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffee20f46f8,0x7ffee20f4708,0x7ffee20f4718
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7798144504388349599,11335761289626552016,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,7798144504388349599,11335761289626552016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,7798144504388349599,11335761289626552016,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7798144504388349599,11335761289626552016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7798144504388349599,11335761289626552016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7798144504388349599,11335761289626552016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7798144504388349599,11335761289626552016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7798144504388349599,11335761289626552016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7798144504388349599,11335761289626552016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7798144504388349599,11335761289626552016,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7798144504388349599,11335761289626552016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7798144504388349599,11335761289626552016,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7798144504388349599,11335761289626552016,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3024 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
255B

MD5
84b28e8ffed9fa0b8f6a91b5b31b308d

SHA1
efaf4dff37c34966c481eef0caf7dacee9e2a78c

SHA256
cf81f066b1ba1e869f5551bbc61c497d91035e2afcb750c3e63d5c7644b0b29c

SHA512
a838f81d13c5ecf02aedcdc60159f4b3f6e22e1f14c566ee3b2765e5645fe0eebabe24124ac018ea64986261c904e5bb50512708babe39bde76d7a5ab9280ea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f03d99b7c7eb18235ab9494690e836c7

SHA1
74c07df0733519944ad7d3dc7292b4f5cb3a935f

SHA256
d4bed87bf1e28a2ecab3f0d494b6b7cd18562349142dcfd27b9a8c77a80ff81a

SHA512
247f2f223eb9f738526339d5cec5ed4a8203224bdc16f005169ffc6db4cd25a6ebfc0c0b48e76a4bd5de2a32e6fa66fdca0be541b3fc217a9f8349f0318b7d45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d51f2d62b53fe36602045d65e6d3e083

SHA1
e4d891d3a68be8154b4e04336495a45194883b5c

SHA256
d2c2179262c7f3e8ed1ff99b2686f596e1d3d38b87921422a69f4d16f542fa37

SHA512
de7249b51ccd60456f3bae3211b00987fe65695c88ccb4dc08b4c3fced13be3a228a0b888bc83c83daf7649579de4dac3a275209acbcf4fd349297fd260affc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb3e6acaa478242e05f8a2bec8d7287e

SHA1
2609fbbc1330ad3764a9c90008314462eacca1e3

SHA256
2002a4fe7a454a88bfce8fa12ff51e97e6b881438114fcaec4b2842b0c9de727

SHA512
d274eb3257819a540bfc93d3426367a80819804f04650e5965e5f0466f70bfd9d4db39fcf2d431e46f13c70c8462cf1052ac0a408101c2a098eaa64b35c15c79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ac26e2612842c86d3f534328f4614164

SHA1
448e14f6dd9e6676f64d6d992563240cff95c06c

SHA256
76f5aed13df5217afd468a3ef7a32992141c1ec69eb2933839dd6fb2d41a8d3c

SHA512
58055c61d18bd7193726757cfab233427cf41dda7d4dcfe365d4d76c44c094a109d9a1a72f57be5ce1137456665ba7c5478918391e822a070cf7a41812589b6d

Download Submit