28240b499e250564dafc38a986c03bba36c6421d3e848a096381ab51ee47d9ea

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa9bbdb14e26aa835f6f8e6c6cbdeb81_JaffaCakes118.html
Size

1KB
MD5

fa9bbdb14e26aa835f6f8e6c6cbdeb81
SHA1

208680e7475c2b5bbad872d64628ff15877647e7
SHA256

28240b499e250564dafc38a986c03bba36c6421d3e848a096381ab51ee47d9ea
SHA512

a33d50889f74f41c235c4e0232b26932b70a2b3a251a8c29d2a01b150feea1415332f95debd16381766f084af6e886f11c44e22c2a14da3916c7a5eb5b94b672

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
2152	msedge.exe
2152	msedge.exe
3736	identity_helper.exe
3736	identity_helper.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 4832	2152	msedge.exe	83
PID 2152 wrote to memory of 4832	2152	msedge.exe	83
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2312	2152	msedge.exe	84
PID 2152 wrote to memory of 2504	2152	msedge.exe	85
PID 2152 wrote to memory of 2504	2152	msedge.exe	85
PID 2152 wrote to memory of 440	2152	msedge.exe	86
PID 2152 wrote to memory of 440	2152	msedge.exe	86
PID 2152 wrote to memory of 440	2152	msedge.exe	86
PID 2152 wrote to memory of 440	2152	msedge.exe	86
PID 2152 wrote to memory of 440	2152	msedge.exe	86
PID 2152 wrote to memory of 440	2152	msedge.exe	86
PID 2152 wrote to memory of 440	2152	msedge.exe	86
PID 2152 wrote to memory of 440	2152	msedge.exe	86
PID 2152 wrote to memory of 440	2152	msedge.exe	86
PID 2152 wrote to memory of 440	2152	msedge.exe	86
PID 2152 wrote to memory of 440	2152	msedge.exe	86
PID 2152 wrote to memory of 440	2152	msedge.exe	86
PID 2152 wrote to memory of 440	2152	msedge.exe	86
PID 2152 wrote to memory of 440	2152	msedge.exe	86
PID 2152 wrote to memory of 440	2152	msedge.exe	86
PID 2152 wrote to memory of 440	2152	msedge.exe	86
PID 2152 wrote to memory of 440	2152	msedge.exe	86
PID 2152 wrote to memory of 440	2152	msedge.exe	86
PID 2152 wrote to memory of 440	2152	msedge.exe	86
PID 2152 wrote to memory of 440	2152	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fa9bbdb14e26aa835f6f8e6c6cbdeb81_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4fd346f8,0x7ffa4fd34708,0x7ffa4fd34718
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5906125796372562817,7700708027358592145,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,5906125796372562817,7700708027358592145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,5906125796372562817,7700708027358592145,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5906125796372562817,7700708027358592145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5906125796372562817,7700708027358592145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5906125796372562817,7700708027358592145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5906125796372562817,7700708027358592145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5906125796372562817,7700708027358592145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5906125796372562817,7700708027358592145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5906125796372562817,7700708027358592145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5906125796372562817,7700708027358592145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5906125796372562817,7700708027358592145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5906125796372562817,7700708027358592145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5906125796372562817,7700708027358592145,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3388 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cff358b013d6f9f633bc1587f6f54ffa

SHA1
6cb7852e096be24695ff1bc213abde42d35bb376

SHA256
39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9

SHA512
8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc629a750e345390344524fe0ea7dcd7

SHA1
5f9f00a358caaef0321707c4f6f38d52bd7e0399

SHA256
38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a

SHA512
2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
189B

MD5
397f53f29a17baee00697ca31a738b65

SHA1
bc300bb2b7797ab6c948a77db2cefad1361d0f7a

SHA256
0dba79eb79d62dbf47c0a71d0802e2f473818740fd5869140da4dbfa54582948

SHA512
b2857d010ac2c15a16838ff92c50042ebf687e293f05bef559769768fc214032dafa75d0ecb41554122b647294999cbc41cfa3c8e3bf9f5bf8d02a32fc057817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
935639b0dd6f9cdc5d8eeee698393522

SHA1
6d88f152354bdf3fa47e6cb7184028ce825e5c33

SHA256
6e80c3cf7a3269d3737c7793894c821993c1c0c9904bfc9585cf4f8a2cea941c

SHA512
c520a64f514ddc439ea53ac07358ea9e773b6e8c40b5f3efb121c49725e503c66ea9a3f733840419b7f004af1f239642430a559cce73d90860bfa5676844a8f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b21acf582b61e5ec44dc35efcaad025c

SHA1
7a93be89b4c8316188106ef71583bf98e248d251

SHA256
318c621aca5def430c5efac56dfe12989bf791b08dbc4b858b2c292ef857f8ac

SHA512
24392b835cf6de64e90c36b7eedc35ac63c1f8a1a83fe54683da38de2151d5383a6f6c96f9a80b67f4877da08beadd11b64124c0bd5ef3d33051111c8169c8f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9b2dfb9ef65017debc465f6b211df1a8

SHA1
7023b1117ea902f83c668a460427135dec676053

SHA256
1889d40e72371c3da75c7b2f6ab46571c996674f6de4d6166fd92ac175064d7e

SHA512
150aa771ef8a916b65e4cdd1f35d0c2e8bfb85e09faa900ab76bf4e28d3ad50ac30d05d58feeca189752b835d707c729958b7516bc4aaa8acd4ea1bf221a8805

Download Submit