5587515224cae3b3965803493a60d72835f784ceeb0fcf2bfad444723d1de44f

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f2af570a2213b38870f997abf625b93e_JaffaCakes118.html
Size

10KB
MD5

f2af570a2213b38870f997abf625b93e
SHA1

99f37b995e9889de04a617fcf7fe397cadc74151
SHA256

5587515224cae3b3965803493a60d72835f784ceeb0fcf2bfad444723d1de44f
SHA512

26913bf302af9ab842854ab8d96dcfbac27a9f255d1a586a5a8663ed6c639c96ea7906f41804bddab0358569c3682abfc4cf140f0e786c62e8f80a823a01787c
SSDEEP

192:Vqaev9pmzFxyWrj3ZHYrdV9HS0rCZ1am0UiyBIoGfGPNAuQRcIqRxU6:sLvSraDrNuPN3f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1732	msedge.exe
1732	msedge.exe
4240	msedge.exe
4240	msedge.exe
780	identity_helper.exe
780	identity_helper.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 2576	4240	msedge.exe	86
PID 4240 wrote to memory of 2576	4240	msedge.exe	86
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 5104	4240	msedge.exe	87
PID 4240 wrote to memory of 1732	4240	msedge.exe	88
PID 4240 wrote to memory of 1732	4240	msedge.exe	88
PID 4240 wrote to memory of 3908	4240	msedge.exe	89
PID 4240 wrote to memory of 3908	4240	msedge.exe	89
PID 4240 wrote to memory of 3908	4240	msedge.exe	89
PID 4240 wrote to memory of 3908	4240	msedge.exe	89
PID 4240 wrote to memory of 3908	4240	msedge.exe	89
PID 4240 wrote to memory of 3908	4240	msedge.exe	89
PID 4240 wrote to memory of 3908	4240	msedge.exe	89
PID 4240 wrote to memory of 3908	4240	msedge.exe	89
PID 4240 wrote to memory of 3908	4240	msedge.exe	89
PID 4240 wrote to memory of 3908	4240	msedge.exe	89
PID 4240 wrote to memory of 3908	4240	msedge.exe	89
PID 4240 wrote to memory of 3908	4240	msedge.exe	89
PID 4240 wrote to memory of 3908	4240	msedge.exe	89
PID 4240 wrote to memory of 3908	4240	msedge.exe	89
PID 4240 wrote to memory of 3908	4240	msedge.exe	89
PID 4240 wrote to memory of 3908	4240	msedge.exe	89
PID 4240 wrote to memory of 3908	4240	msedge.exe	89
PID 4240 wrote to memory of 3908	4240	msedge.exe	89
PID 4240 wrote to memory of 3908	4240	msedge.exe	89
PID 4240 wrote to memory of 3908	4240	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f2af570a2213b38870f997abf625b93e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbae446f8,0x7fffbae44708,0x7fffbae44718
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,7959079752027658486,4169133505205585413,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,7959079752027658486,4169133505205585413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,7959079752027658486,4169133505205585413,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7959079752027658486,4169133505205585413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7959079752027658486,4169133505205585413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,7959079752027658486,4169133505205585413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,7959079752027658486,4169133505205585413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7959079752027658486,4169133505205585413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7959079752027658486,4169133505205585413,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7959079752027658486,4169133505205585413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7959079752027658486,4169133505205585413,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,7959079752027658486,4169133505205585413,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
894B

MD5
6925e04f2b8547351ca97f872b378713

SHA1
c23d7d990ae2e6cf47453f231d88fbff6bb7ea27

SHA256
e284cddf30b599643ae864cd2883711e6f27a02d85d61efc11fcd76a938a27fb

SHA512
92a290aec12e25d5190709d3d9b7e19f3c14eca691569733378a31e2b2e0975e7460eb82afe6db23eced1dc98f0b573dc9ed8cea7e23cad7d8e10b4d1f5cb2ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f6b50b3cb54968af355575129bcd48bb

SHA1
00ab7eaa2b58e7136b6cead750a876111146972e

SHA256
4c1ef81af3c72e3e062b11940c9d3236cb18b2ac6d72eeda5eda48c38719f994

SHA512
5aed82e49a7d8322a51da809fb2fe577f465727c58eb2d3ae7fe919062941f43425c4afa1fffe27f12127f2d559ddede686903a407c04f60005b20f5dbb3af1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
91c050c3c37e3b7909bad8999ab029d4

SHA1
982ad536e019bf181e25622ffec762611f7cedad

SHA256
a1c824c0473f7e99312b1c9acb6bf415f5afdbfd0a72638bc480276e05176d10

SHA512
a0cf6ef01177a087635330550accd63e50f16420eb26d3e894be601930946cd2f37c08a849e0201238924c5c5afa4909c7cfb5a136b6749cdd4c3d7183260130

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
91fc787d7d9dd1f74f041c83ed750685

SHA1
c15f937d5eb45f5b10c4566db942664a0c82761e

SHA256
3a030a1a0e35f3de396f4eb6cc63f3c77a36b5438d53e34ba1dba26be1ddb3d2

SHA512
9a01acfa4900d7b119a0248cebdfb6b7faabf434e2843cd2a2ab04c78bd5dc34b4994307f0d136529cb9ba974c945073f94015e85c6ca9e788851e2ccbde0296

Download Submit