e279dde0ffc4e8cfb1b708a7f34d2b2d1c7abc4bffb7826815da401c66a7e23e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fae84bb3fa021aae636675c2201f30be_JaffaCakes118.html
Size

9KB
MD5

fae84bb3fa021aae636675c2201f30be
SHA1

f9ceecb3d60d7539ea04d2338ab2168676c50b8d
SHA256

e279dde0ffc4e8cfb1b708a7f34d2b2d1c7abc4bffb7826815da401c66a7e23e
SHA512

17773c5253fe8ff34c25cbafea2a747b356793b849c0382910a2c230fe152e258d4800296cfe67cc5a06314772f7bb6457eb74e32fff65bc92b75ef6b93e0582
SSDEEP

96:uzVs+ux781LLY1k9o84d12ef7CSTUOGT/kENpHFb6dalVHcEZ7ru7f:csz781AYS/naHFPPHb76f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
1748	msedge.exe
1748	msedge.exe
3152	identity_helper.exe
3152	identity_helper.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2312	1748	msedge.exe	84
PID 1748 wrote to memory of 2312	1748	msedge.exe	84
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 3648	1748	msedge.exe	85
PID 1748 wrote to memory of 2652	1748	msedge.exe	86
PID 1748 wrote to memory of 2652	1748	msedge.exe	86
PID 1748 wrote to memory of 3376	1748	msedge.exe	87
PID 1748 wrote to memory of 3376	1748	msedge.exe	87
PID 1748 wrote to memory of 3376	1748	msedge.exe	87
PID 1748 wrote to memory of 3376	1748	msedge.exe	87
PID 1748 wrote to memory of 3376	1748	msedge.exe	87
PID 1748 wrote to memory of 3376	1748	msedge.exe	87
PID 1748 wrote to memory of 3376	1748	msedge.exe	87
PID 1748 wrote to memory of 3376	1748	msedge.exe	87
PID 1748 wrote to memory of 3376	1748	msedge.exe	87
PID 1748 wrote to memory of 3376	1748	msedge.exe	87
PID 1748 wrote to memory of 3376	1748	msedge.exe	87
PID 1748 wrote to memory of 3376	1748	msedge.exe	87
PID 1748 wrote to memory of 3376	1748	msedge.exe	87
PID 1748 wrote to memory of 3376	1748	msedge.exe	87
PID 1748 wrote to memory of 3376	1748	msedge.exe	87
PID 1748 wrote to memory of 3376	1748	msedge.exe	87
PID 1748 wrote to memory of 3376	1748	msedge.exe	87
PID 1748 wrote to memory of 3376	1748	msedge.exe	87
PID 1748 wrote to memory of 3376	1748	msedge.exe	87
PID 1748 wrote to memory of 3376	1748	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fae84bb3fa021aae636675c2201f30be_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe85846f8,0x7fffe8584708,0x7fffe8584718
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16844339694268750687,412654241283020505,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,16844339694268750687,412654241283020505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,16844339694268750687,412654241283020505,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16844339694268750687,412654241283020505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16844339694268750687,412654241283020505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16844339694268750687,412654241283020505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16844339694268750687,412654241283020505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16844339694268750687,412654241283020505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16844339694268750687,412654241283020505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16844339694268750687,412654241283020505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16844339694268750687,412654241283020505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16844339694268750687,412654241283020505,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cff358b013d6f9f633bc1587f6f54ffa

SHA1
6cb7852e096be24695ff1bc213abde42d35bb376

SHA256
39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9

SHA512
8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc629a750e345390344524fe0ea7dcd7

SHA1
5f9f00a358caaef0321707c4f6f38d52bd7e0399

SHA256
38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a

SHA512
2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
766d93b168905ba7cb42e7fca67b7eec

SHA1
6b94bd5e64eebe431bc36507e6b904cac2b3a725

SHA256
b7b1a1a7be36f7f950fd5ebae682949b5e5cb8a1f1aba52a0c0cd3500b75a7c2

SHA512
bd2fc63bd7482e3094ef307d6a04289bcb2854f7555aaa11b4d795f5e21a5a1967f5110e2191c4178f7b03770d611096a9b89aa00e21c008351d85f0c18bdd4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a11943469e14d0cba31ed5bbbc7de522

SHA1
03d7f58757d97edfae35c436d0424008fe95e7bf

SHA256
6b6d42dc2e6ef3ab3d05854f48ebae13480b0eb2448702c1ffe1e2084485cf07

SHA512
7fff4833124742b47953a13a778b186a794665729ee7aaeef5e9a4c05b5f263f4fb7e1adc268b3f7058e26e4dd7f93e198f630e7bc197ca3cd32ea83b7459a13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
52410428b4d17a001b10c3ea7fa1fca9

SHA1
e0c7c155d40e1c4071c0dc66f4e65bd12190c705

SHA256
f5c2890ebff423423cd4b933281072e93bdca9d78f6365e78530a614befe1116

SHA512
03947612e584c702c0a9e6160d979c52defcb2043f20a4fc0474e4982f9ca72ba564b91c7a734663a6a8b22b147de480ec55a918d53cd9e13912488bd0dfc6e2

Download Submit