e5be41693f359643b3de41ecdfa070351ef9feb7d537d56539f38e857b382d2d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fdd2d1e702b643b196a122145a0fa099_JaffaCakes118.html
Size

9KB
MD5

fdd2d1e702b643b196a122145a0fa099
SHA1

3ee56e842d7816f9431ace473acb1bf278146832
SHA256

e5be41693f359643b3de41ecdfa070351ef9feb7d537d56539f38e857b382d2d
SHA512

70772ae46f63723053ebc9d3804f26f785d0115ed98f695643117abb384bdadbe6c2ce86ece9fd0250d9a561e57fd5b6c412a8bc8dd314fb4f031756dd7ba964
SSDEEP

96:uzVs+ux7tOLLY1k9o84d12ef7CSTUHGT/kTsOOpqaK35RlVHcEZ7ru7f:csz7tOAYS/iTVUTgPHb76f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
3712	msedge.exe
3712	msedge.exe
2524	identity_helper.exe
2524	identity_helper.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 1344	3712	msedge.exe	86
PID 3712 wrote to memory of 1344	3712	msedge.exe	86
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 3228	3712	msedge.exe	87
PID 3712 wrote to memory of 4284	3712	msedge.exe	88
PID 3712 wrote to memory of 4284	3712	msedge.exe	88
PID 3712 wrote to memory of 5404	3712	msedge.exe	89
PID 3712 wrote to memory of 5404	3712	msedge.exe	89
PID 3712 wrote to memory of 5404	3712	msedge.exe	89
PID 3712 wrote to memory of 5404	3712	msedge.exe	89
PID 3712 wrote to memory of 5404	3712	msedge.exe	89
PID 3712 wrote to memory of 5404	3712	msedge.exe	89
PID 3712 wrote to memory of 5404	3712	msedge.exe	89
PID 3712 wrote to memory of 5404	3712	msedge.exe	89
PID 3712 wrote to memory of 5404	3712	msedge.exe	89
PID 3712 wrote to memory of 5404	3712	msedge.exe	89
PID 3712 wrote to memory of 5404	3712	msedge.exe	89
PID 3712 wrote to memory of 5404	3712	msedge.exe	89
PID 3712 wrote to memory of 5404	3712	msedge.exe	89
PID 3712 wrote to memory of 5404	3712	msedge.exe	89
PID 3712 wrote to memory of 5404	3712	msedge.exe	89
PID 3712 wrote to memory of 5404	3712	msedge.exe	89
PID 3712 wrote to memory of 5404	3712	msedge.exe	89
PID 3712 wrote to memory of 5404	3712	msedge.exe	89
PID 3712 wrote to memory of 5404	3712	msedge.exe	89
PID 3712 wrote to memory of 5404	3712	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fdd2d1e702b643b196a122145a0fa099_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ff9eddb46f8,0x7ff9eddb4708,0x7ff9eddb4718
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18261847390267268903,12562498493704895084,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,18261847390267268903,12562498493704895084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,18261847390267268903,12562498493704895084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18261847390267268903,12562498493704895084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18261847390267268903,12562498493704895084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18261847390267268903,12562498493704895084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18261847390267268903,12562498493704895084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18261847390267268903,12562498493704895084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18261847390267268903,12562498493704895084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18261847390267268903,12562498493704895084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18261847390267268903,12562498493704895084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18261847390267268903,12562498493704895084,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
01ad70aeab014c9b2ba443777612f178

SHA1
ddb4af012dbb91b589cc5838837ae44ffa186216

SHA256
546a218ca91144a565e2532f06cb84747019606bd3a056bb8745581207ccfcb1

SHA512
67051f26a0c3ead4f1cf4151f3163080fbaf9a41330f678b807b9ceac4a7d1a94615a61e18f68f9839f4d54973406d20af4082dcf02f7f3942e2bb12c114b3d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f793cd0d1cc8a1b0cab53e982674a4c

SHA1
62bc48f6a987a575685610f4cbb48dd5e8fbbd57

SHA256
836dd117a9f4b38a5497a9ee764b6644d3321d4da287890c63aefe73c35efe15

SHA512
2ac53c91484637ac313c399bd1f22890338653988acbd694263c7fa64653cbc7643f3a595aec1aca254496ed036956d441377d0212009e352adb5914802a5300

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
16ee18f25a569541d46ae68fb8022013

SHA1
ccba5590cc456a811dc66e2598639794fdeba53d

SHA256
7b8f2b43f20dd1cc0ec7dc4bb40356f6a8af3bade37e948a0fabc257dc2ae7c6

SHA512
eeb29b3f909565066e870c59e3e0f6da3a671078f6543cc5a3befcd8afc2454accd7ca305d1b6de380c827961db1be9af85364c6d1d7f4b9899a86ba3c1eebec

Download Submit