bb5f6a73045f2c0d9cd52d8897c58d5da74f1a8240452d5955afdc8576fe860d

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f957ecd1cfaa287a03b0b629f9e7d8b0_JaffaCakes118.html
Size

598B
MD5

f957ecd1cfaa287a03b0b629f9e7d8b0
SHA1

bf24bdf2c3676eb8b4a5a790622504666d9c81fe
SHA256

bb5f6a73045f2c0d9cd52d8897c58d5da74f1a8240452d5955afdc8576fe860d
SHA512

62c13e146abb786a48312c2e689ecc7fbb055c7800bb0b62d179b495ad7934eb8e06b6bf88dcc53c628db63b11637ba5286e98e0e1aa222d4ca78093247c0efe

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
4252	msedge.exe
4252	msedge.exe
1052	identity_helper.exe
1052	identity_helper.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 2512	4252	msedge.exe	86
PID 4252 wrote to memory of 2512	4252	msedge.exe	86
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 4872	4252	msedge.exe	87
PID 4252 wrote to memory of 3280	4252	msedge.exe	88
PID 4252 wrote to memory of 3280	4252	msedge.exe	88
PID 4252 wrote to memory of 1552	4252	msedge.exe	89
PID 4252 wrote to memory of 1552	4252	msedge.exe	89
PID 4252 wrote to memory of 1552	4252	msedge.exe	89
PID 4252 wrote to memory of 1552	4252	msedge.exe	89
PID 4252 wrote to memory of 1552	4252	msedge.exe	89
PID 4252 wrote to memory of 1552	4252	msedge.exe	89
PID 4252 wrote to memory of 1552	4252	msedge.exe	89
PID 4252 wrote to memory of 1552	4252	msedge.exe	89
PID 4252 wrote to memory of 1552	4252	msedge.exe	89
PID 4252 wrote to memory of 1552	4252	msedge.exe	89
PID 4252 wrote to memory of 1552	4252	msedge.exe	89
PID 4252 wrote to memory of 1552	4252	msedge.exe	89
PID 4252 wrote to memory of 1552	4252	msedge.exe	89
PID 4252 wrote to memory of 1552	4252	msedge.exe	89
PID 4252 wrote to memory of 1552	4252	msedge.exe	89
PID 4252 wrote to memory of 1552	4252	msedge.exe	89
PID 4252 wrote to memory of 1552	4252	msedge.exe	89
PID 4252 wrote to memory of 1552	4252	msedge.exe	89
PID 4252 wrote to memory of 1552	4252	msedge.exe	89
PID 4252 wrote to memory of 1552	4252	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f957ecd1cfaa287a03b0b629f9e7d8b0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93e8946f8,0x7ff93e894708,0x7ff93e894718
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16554776910139302440,11570700684276811001,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,16554776910139302440,11570700684276811001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,16554776910139302440,11570700684276811001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16554776910139302440,11570700684276811001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16554776910139302440,11570700684276811001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16554776910139302440,11570700684276811001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16554776910139302440,11570700684276811001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16554776910139302440,11570700684276811001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16554776910139302440,11570700684276811001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16554776910139302440,11570700684276811001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16554776910139302440,11570700684276811001,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16554776910139302440,11570700684276811001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16554776910139302440,11570700684276811001,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16554776910139302440,11570700684276811001,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cff358b013d6f9f633bc1587f6f54ffa

SHA1
6cb7852e096be24695ff1bc213abde42d35bb376

SHA256
39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9

SHA512
8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc629a750e345390344524fe0ea7dcd7

SHA1
5f9f00a358caaef0321707c4f6f38d52bd7e0399

SHA256
38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a

SHA512
2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
254B

MD5
1fdaf17a1454668920a9ccac73007391

SHA1
e680ad8400c490a201a40e24cf5c577e4542cf2b

SHA256
58d9ead7bf2604a5738301d6d8735a63c311b6205b37d15311c3bb7f9f8b3788

SHA512
58a8b7c3cba16ef76a12da029c0db932c2ef7801bb7a782fe9dcf7d3352658dfefd653318bfdb3dfb845125b3b7ccf254ed8c3afe4e75f326dccb43f5eabe501

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce30f36bd593946366de41c1966c36cf

SHA1
b5804b910cb64cc030f1ce9b1df6a690a15927d8

SHA256
cd8030d9fe1934b8a936c0202b3f86ac66e88f9b734976f549a9566ed516851d

SHA512
fad73d5b4c9a8520e7ffd2c55ab9788e335c607d92904b8b35c57ccbadee7363cb880bb41651d104e7ae951ee8f8faa054bcb66bc9319edf55191e8f57004636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b9fb8e4dd453267f3868d0f959509c8

SHA1
ea0c3ebf05c6e23ef72206c779b904c2ef62e5f1

SHA256
67644423dcdccb777dd05768e8671378f80a0e79bc7adc9010f2a02bbdf51f87

SHA512
6a555e8ce9f7959cda9bd541bfa63d0aa3b9fef652c6cc90b64d2d4f53db6f604518b0b6d5c96b1f277de40df9de9a0cf6b15ec7af8080e7b5872e99a44f43b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
05ce25c4c6d461f113349740e97e0ce5

SHA1
81c9d4cd78c9e028f00b5b9cb34626f0158ff416

SHA256
852470a18987a9855b3900e4b956705c412689f24ed6eeb90d9217abd571ac17

SHA512
33183af6e8dac3e0db4aeb4a3fb1816c04539a334ea1798bb8f5807dd982b6058dbc7774a69bae3b1cecb552182b40db866342b8dead092dfa260ef1671bc01a

Download Submit