e9514c92b664b6a2fbb4f8d13a4bd4ac1bcb83e7e878274f2fa1f0351a749701

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f87acd0c4f6e802719be3470900d50ac_JaffaCakes118.html
Size

53KB
MD5

f87acd0c4f6e802719be3470900d50ac
SHA1

f207dedf8353983e356aa89227b827bfb16f5e33
SHA256

e9514c92b664b6a2fbb4f8d13a4bd4ac1bcb83e7e878274f2fa1f0351a749701
SHA512

9297abc11a876acbba7546f3428d5783fb08222cee8c6847180cb5fdb5fcb575f56325b919fec92e64c8ae2aa7e5b20b1f5e14bfb2a39d26af0e0060002d8c1e
SSDEEP

1536:CkgUiIakTqGivi+PyUhrunlY263Nj+q5VyvR0w2AzTICbblo3/t9M/dNwIUTDmD+:CkgUiIakTqGivi+PyUhrunlY263Nj+qD

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
2888	msedge.exe
2888	msedge.exe
4380	identity_helper.exe
4380	identity_helper.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 4976	2888	msedge.exe	80
PID 2888 wrote to memory of 4976	2888	msedge.exe	80
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 1252	2888	msedge.exe	82
PID 2888 wrote to memory of 3756	2888	msedge.exe	83
PID 2888 wrote to memory of 3756	2888	msedge.exe	83
PID 2888 wrote to memory of 3912	2888	msedge.exe	84
PID 2888 wrote to memory of 3912	2888	msedge.exe	84
PID 2888 wrote to memory of 3912	2888	msedge.exe	84
PID 2888 wrote to memory of 3912	2888	msedge.exe	84
PID 2888 wrote to memory of 3912	2888	msedge.exe	84
PID 2888 wrote to memory of 3912	2888	msedge.exe	84
PID 2888 wrote to memory of 3912	2888	msedge.exe	84
PID 2888 wrote to memory of 3912	2888	msedge.exe	84
PID 2888 wrote to memory of 3912	2888	msedge.exe	84
PID 2888 wrote to memory of 3912	2888	msedge.exe	84
PID 2888 wrote to memory of 3912	2888	msedge.exe	84
PID 2888 wrote to memory of 3912	2888	msedge.exe	84
PID 2888 wrote to memory of 3912	2888	msedge.exe	84
PID 2888 wrote to memory of 3912	2888	msedge.exe	84
PID 2888 wrote to memory of 3912	2888	msedge.exe	84
PID 2888 wrote to memory of 3912	2888	msedge.exe	84
PID 2888 wrote to memory of 3912	2888	msedge.exe	84
PID 2888 wrote to memory of 3912	2888	msedge.exe	84
PID 2888 wrote to memory of 3912	2888	msedge.exe	84
PID 2888 wrote to memory of 3912	2888	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f87acd0c4f6e802719be3470900d50ac_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8a3746f8,0x7ffa8a374708,0x7ffa8a374718
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16472154977211403602,18205849955802432668,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16472154977211403602,18205849955802432668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16472154977211403602,18205849955802432668,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16472154977211403602,18205849955802432668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16472154977211403602,18205849955802432668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16472154977211403602,18205849955802432668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16472154977211403602,18205849955802432668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16472154977211403602,18205849955802432668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16472154977211403602,18205849955802432668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16472154977211403602,18205849955802432668,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16472154977211403602,18205849955802432668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16472154977211403602,18205849955802432668,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16472154977211403602,18205849955802432668,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
402B

MD5
1cb0c080c82b07002c4425a8bad98f84

SHA1
fb1a1ac3f99c1bed2aa493302d85b63785b3ace6

SHA256
06650b565a4d07544acf104027ef1dd8a829193b49409861a7822655059e56fb

SHA512
45b20c5e20aacb52238415e53d6a1efefbda64bd91e4812c9e32a7b3842aef63b373cda38b2c2dfc5f9c52cd0757e396975a9bda4cb588e39f50ad8224fa437a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
827b8c5fb1865eed9de4824dfe27a260

SHA1
9261d9a4cc48bf3c7076fdcda4ed75c9dce2c064

SHA256
cca2952aaa236e9da19b5a4a338bce163c9786e28ccffa829e6876d3d165dcb5

SHA512
ba5420da1ae46754a7f51ff718a9c7588075c08970752a212c163f6fb058e417d09d4f52e4d340e4477eff8acfb347c7d0b8777f407d0b618418eb39b9071780

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
546311d455ddf83c253700c43b8935d0

SHA1
70628de00088e8a22cf7f81c2d55f4b6fde1a8ea

SHA256
5622abdce13c90ba3a1eb6f95327c150cca88425a2c35cca447d0eefa3b82777

SHA512
0d08cd67fa1741f63b31f3d17dfa9e5753d52a89cfaf36f62364fc1760bf61809de3793fb9d0c7757b1612908686374a81c604c08b4884b67983bfc398f6e0a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6347a7adf3ab8175624756e2734efe5e

SHA1
f3c984d49afadecbdf3e17081d75eaf13cd31f2a

SHA256
c0940364ea522dfb8ea24da8787975965dc7e749ee62e11f35fa06ff3c2b584e

SHA512
3e1723c993fbf8e23e37089a7f9851185fae71c729b92cfa4ea774ee34deaa975be3e93f22b11454f50379bb34d6835309cd21a129ab4d044de92adfd1254f36

Download Submit