bfea3e967124389d6a86a32333d57b6d489459a67e7d1ae2a4b2034f1bc19278

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f057370f6fe46e63a44f12b676e3669b_JaffaCakes118.html
Size

2KB
MD5

f057370f6fe46e63a44f12b676e3669b
SHA1

2fd702cdb39774c94c9c8001f7eb39343838bc3b
SHA256

bfea3e967124389d6a86a32333d57b6d489459a67e7d1ae2a4b2034f1bc19278
SHA512

a2ee050ddc1b8dfe757b35a7d13832b9ab947a5ec5abf05a1a4ce43a7343225e3d61229cc962eeb4c120a720f16b1b44520c2514329a40b4a394f7ff22d4006d

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
976	msedge.exe
976	msedge.exe
1988	msedge.exe
1988	msedge.exe
4788	identity_helper.exe
4788	identity_helper.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 4448	1988	msedge.exe	85
PID 1988 wrote to memory of 4448	1988	msedge.exe	85
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 4896	1988	msedge.exe	86
PID 1988 wrote to memory of 976	1988	msedge.exe	87
PID 1988 wrote to memory of 976	1988	msedge.exe	87
PID 1988 wrote to memory of 1096	1988	msedge.exe	88
PID 1988 wrote to memory of 1096	1988	msedge.exe	88
PID 1988 wrote to memory of 1096	1988	msedge.exe	88
PID 1988 wrote to memory of 1096	1988	msedge.exe	88
PID 1988 wrote to memory of 1096	1988	msedge.exe	88
PID 1988 wrote to memory of 1096	1988	msedge.exe	88
PID 1988 wrote to memory of 1096	1988	msedge.exe	88
PID 1988 wrote to memory of 1096	1988	msedge.exe	88
PID 1988 wrote to memory of 1096	1988	msedge.exe	88
PID 1988 wrote to memory of 1096	1988	msedge.exe	88
PID 1988 wrote to memory of 1096	1988	msedge.exe	88
PID 1988 wrote to memory of 1096	1988	msedge.exe	88
PID 1988 wrote to memory of 1096	1988	msedge.exe	88
PID 1988 wrote to memory of 1096	1988	msedge.exe	88
PID 1988 wrote to memory of 1096	1988	msedge.exe	88
PID 1988 wrote to memory of 1096	1988	msedge.exe	88
PID 1988 wrote to memory of 1096	1988	msedge.exe	88
PID 1988 wrote to memory of 1096	1988	msedge.exe	88
PID 1988 wrote to memory of 1096	1988	msedge.exe	88
PID 1988 wrote to memory of 1096	1988	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f057370f6fe46e63a44f12b676e3669b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8611c46f8,0x7ff8611c4708,0x7ff8611c4718
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,1098412524359282533,16803453288533505874,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,1098412524359282533,16803453288533505874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,1098412524359282533,16803453288533505874,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,1098412524359282533,16803453288533505874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,1098412524359282533,16803453288533505874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,1098412524359282533,16803453288533505874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,1098412524359282533,16803453288533505874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,1098412524359282533,16803453288533505874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,1098412524359282533,16803453288533505874,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,1098412524359282533,16803453288533505874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,1098412524359282533,16803453288533505874,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,1098412524359282533,16803453288533505874,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5276 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ff4360d6f634dc7a2dce073822e59b0

SHA1
0c8a9be0b6921b550ce172a5b0dce07ccfe2e954

SHA256
7cc5e4ddb32ba154c4314ff2ed71fb7c3a2ff474663f617932ddd9ba21c26903

SHA512
8df027a158d5bae5b3e64b458327c6cf1bfe82c47ae543215bc34da9bf6da05507dfdf9072e9124be09d846f2a6616701f28f225d1696cb435ffa2865a9ced2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9b43a2a3592ab21c91a2db07ac33da27

SHA1
b4e96ca5cd10cb96c1080df58efb960282bd21f0

SHA256
5712a082ae440ee21072c63a1f8c038d99d453191739a80cf2e537dd6effabc4

SHA512
72e46129f3a5203b9c79bcf15366f13c293334006c79cddfb985cde4ac19bc59187409df2b04a73016f332803eca7be674e80ef7be2690dfa9260ab6fb779966

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
52553c58c1c2897133c082f3796095cd

SHA1
dfd4a133d0f0720559cb5a736efa6a07bce2e23d

SHA256
80bf5bef653e610fd25d708461db6acf1564a4fc2f35b46f1fde925855813e69

SHA512
425013391d5fd671560f5791dd20b047d7037c50a539f5e00fab4b52494747c8398be92fb303c6e7750fadb9f1415f120687daea6e8e1103c3d86a9db64783f4

Download Submit